HTTP status codes quick reference
The status codes you most often see from APIs and CDNs, from 200 OK to 504 Gateway Timeout. Rare experimental codes are left out.
| Code | Name | Meaning |
|---|---|---|
| 200 | OK | Success with body |
| 201 | Created | Resource created |
| 204 | No Content | Success, empty body |
| 301 | Moved Permanently | Permanent redirect |
| 302 | Found | Temporary redirect |
| 304 | Not Modified | Use cached copy |
| 400 | Bad Request | Client request invalid |
| 401 | Unauthorized | Auth required / failed |
| 403 | Forbidden | Authenticated but denied |
| 404 | Not Found | No such resource |
| 405 | Method Not Allowed | Wrong HTTP method |
| 408 | Request Timeout | Client too slow |
| 409 | Conflict | State conflict |
| 410 | Gone | Permanently removed |
| 422 | Unprocessable Entity | Semantics invalid |
| 429 | Too Many Requests | Rate limited |
| 500 | Internal Server Error | Server fault |
| 502 | Bad Gateway | Upstream invalid |
| 503 | Service Unavailable | Overloaded / down |
| 504 | Gateway Timeout | Upstream timeout |
Notes
- 401 vs 403: missing or failed credentials versus signed in but not allowed.
- A CDN may return 5xx when the origin server cannot be reached.
The five classes of status code
The first digit tells you who is responsible and roughly what happened. 1xx are informational and rarely seen by clients. 2xx mean success — 200 OK with a body, 204 No Content with none, 206 for a partial download. 3xx mean the resource is somewhere else. 4xx mean the request itself is wrong: bad syntax, missing credentials or a rate limit. 5xx mean the server failed even though the request was fine. Reading only the first digit already tells you whether to fix the client or escalate to the server side.
Choosing the right redirect
301 and 308 both mean permanent; 302 and 307 both mean temporary. The difference is how the method is handled: 301 and 302 historically let clients turn a POST into a GET, while 307 and 308 preserve the original method and body, which matters for APIs and form submissions. Use 301 for a URL that has genuinely moved for good, and 302 or 307 for temporary routing such as maintenance pages or A/B tests. Beware chains — every extra hop costs latency and link equity, so redirect straight to the final destination.
Sorting out 4xx errors
401 means authentication is missing or failed, so sending valid credentials can resolve it; 403 means the request was understood and authenticated but is not allowed, and retrying with the same credentials will not help. 404 means the resource does not exist; 410 signals it existed and is deliberately gone. 429 means you hit a rate limit and should back off, honouring any Retry-After header. 400 usually means malformed input, 405 means the method is wrong for that URL, and 422 means the syntax was valid but the content failed validation.
Reading 5xx codes
500 is a generic internal error; 502 Bad Gateway means an upstream server returned something unusable; 503 means the service is temporarily unavailable or overloaded; 504 means an upstream timed out. These are the server's problem, not the caller's, so the fix is retrying with backoff, checking upstream health, or shedding load. A CDN can emit 502, 503 or 504 on behalf of an origin it cannot reach, which is why the same error can come from two very different places — check the server and cache-status headers to find out which.
Status codes in practice: APIs and caching
Two everyday uses repay attention. First, caching: 200 with a Cache-Control header can be stored, 304 Not Modified tells the client to reuse its copy, and a 5xx should not be cached. Second, APIs: a POST that creates a resource should return 201 with a Location header, DELETE often returns 204, and a PATCH that changes nothing may return 200 or 204. Well-behaved clients branch on the class first (2xx, 4xx, 5xx) and only then on the exact code, which keeps retry and backoff logic simple and predictable.
Frequently asked questions
- What does HTTP 403 mean?
- 403 Forbidden means the server understood and authenticated the request but refuses to grant access to the resource. Unlike 401, logging in again will not help.
- What is the difference between HTTP 301 and 302 redirects?
- 301 means the resource has moved permanently, so clients and search engines should use the new URL from now on. 302 is a temporary redirect and the original URL remains valid.
- What does HTTP 429 mean and how do I fix it?
- 429 Too Many Requests means you have hit a rate limit. Slow down your requests and honor the Retry-After header if the server provides one.