HTTP Status Codes

What is this for?

HTTP status codes are the three-digit numbers a server returns to a client to communicate the outcome of a request. They're grouped into five families: 1xx (informational), 2xx (success), 3xx (redirection), 4xx (client error), and 5xx (server error). Most developers know the common codes — 200, 301, 404, 500 — but the specification defines dozens more, and choosing the right one matters for API reliability, SEO, client behaviour, and debugging. This tool gives you the complete reference: meaning, use case, and the RFC where each code is formally defined.

When to use it

• Reading API documentation or error logs and encountering an unfamiliar code (425? 451? 308?) — look it up in seconds.
• Designing your own API and deciding which status code to return — 404 vs 410, 401 vs 403, 422 vs 400, 200 vs 201.
• Debugging production issues: a 502 Bad Gateway usually means the upstream is down or unreachable, while 504 Gateway Timeout suggests it's responding too slowly.
• Reviewing code or design documents and needing the authoritative RFC reference to back up your choice.
• Deciding whether to return a 2xx status with an error object in the body, or a proper 4xx/5xx — they have different semantic meanings and client implications.
• Understanding why a third-party service is returning an unexpected code and what you should do about it.

How it works

• Type or paste a status code (e.g. 429, 503) into the search box, or scroll the full list.
• Filter as you type — results narrow down instantly across code number, name, and description.
• Click any result to see the full details: plain-English meaning, typical causes, and the relevant RFC (usually RFC 9110 for modern codes).
• Use the family groupings (1xx, 2xx, 3xx, etc.) to browse codes by category if you're exploring or learning.
• Reference the RFC link for the normative specification if you're writing specs or need legal/formal wording.

Common gotchas

• 401 vs 403 — 401 means "I don't know who you are" (unauthenticated); 403 means "I know who you are and you're not allowed" (unauthorised). Only use 403 if authentication alone wouldn't fix the problem.
• 302 vs 307 vs 303 — A 302 redirect is ambiguous: browsers may change POST to GET (a legacy quirk). Use 307 to preserve the original method, or 303 to explicitly require GET. Be explicit in new APIs.
• 404 vs 410 — 404 means "not found right now, might come back"; 410 means "gone permanently, remove from indices". Search engines treat 410 as a deletion signal; use it when you're retiring a resource.
• 200 with error body — Returning HTTP 200 with an error message in the JSON body is not RESTful and breaks client expectations. Return the appropriate 4xx or 5xx with the error in the body instead.
• 418 I'm a teapot — This is an April Fools' RFC joke (7168). Don't use it in production; some clients and proxies handle it unpredictably.
• RFC 9110 is current — RFC 9110 (June 2022) supersedes the older RFCs 7231–7235. Cite 9110 unless you have a reason to reference an older spec.

Status code families at a glance

• 1xx (Informational) — Server is still processing. Rarely seen by end users; mostly used for 100 Continue in request/response negotiation.
• 2xx (Success) — Request succeeded. 200 (OK), 201 (Created), 204 (No Content), and 206 (Partial Content) are the most common.
• 3xx (Redirection) — Client must take further action. Includes redirects (301, 302, 307, 308), caching directives (304), and special cases (307, 308).
• 4xx (Client Error) — Client's fault: bad syntax, auth failure, resource not found, rate limiting. Server should not retry.
• 5xx (Server Error) — Server's fault: internal error, not implemented, gateway trouble, overloaded. Client may retry (especially 503, 504).