HTTP Status Codes
Every HTTP status code with its meaning, when to return it, what to do when you receive it, and a link to the defining RFC.
Class legend
1xx the request was received and processing continues · 2xx it worked · 3xx go somewhere else to finish it · 4xx the request was wrong, fixing it is the client's job · 5xx the request looked fine but the server failed.
No status code matches that search.
How to use this status code reference
- Type the number you got back —
404,429,502— or a word like "redirect" or "auth" to find the right code. - Use the class chips to browse one family at a time: 1xx, 2xx, 3xx, 4xx or 5xx.
- Read the "when to use it" note to decide which code your own API should return, and follow the RFC link for the exact wording of the spec.
FAQ
301 or 302 — which redirect should I use?
Use 301 when the new URL is permanent: browsers and search engines cache it and pass on ranking signals. Use 302 (or better, 307) for anything temporary, such as sending a logged-out visitor to a sign-in page. 307 and 308 additionally guarantee that the HTTP method is not changed.
401 or 403?
401 Unauthorized means "I do not know who you are" — credentials are missing or invalid, and the response must include a WWW-Authenticate header. 403 Forbidden means "I know who you are and you still may not do this"; re-authenticating will not help.
Why do I keep seeing 502 and 504?
Both come from a proxy, load balancer or CDN in front of your app. 502 means the upstream returned something invalid or refused the connection; 504 means it never answered in time. Check the application logs behind the proxy rather than the proxy itself.