HTTP Status Code Reference
Searchable dictionary of standard HTTP response status codes.
Continue
The initial part of the request was received; the client should continue sending the request body.
Switching Protocols
The server agrees to switch protocols as requested via the Upgrade header (e.g. to WebSocket).
Processing
Interim response indicating the server accepted the request but has not completed it. Deprecated.
Early Hints
Preliminary response used to send Link headers (preload/preconnect) before the final response.
Upload Resumption Supported
Interim response indicating the server supports resumable uploads (temporary IANA registration).
OK
The request succeeded. The payload depends on the request method.
Use for: Successful GET/PUT/PATCH with a response body.
Created
The request was fulfilled and resulted in a new resource being created.
Use for: Successful POST/PUT that created a resource; include a Location header.
Accepted
The request has been accepted for processing, but processing has not completed.
Use for: Async processing: work queued but not finished.
Non-Authoritative Information
The response was modified by a transforming proxy from the origin's 200 response.
No Content
The request succeeded and there is no content to send in the response body.
Use for: Successful DELETE, or PUT/POST with nothing to return.
Reset Content
The request succeeded; the client should reset the document view (e.g. clear a form).
Partial Content
The server is delivering only part of the resource due to a Range header.
Use for: Range requests: resumable downloads, video streaming.
Multi-Status
Conveys multiple status codes for multiple independent operations (XML body).
Already Reported
Members of a DAV binding were already enumerated earlier in the same multistatus response.
This Is Fine
Apache with ProxyErrorOverride: allows passing an error body while masking the upstream error.
IM Used
The response is a representation of the result of one or more instance-manipulations (delta encoding).
Multiple Choices
The target resource has multiple representations; the client should pick one.
Moved Permanently
The resource has been assigned a new permanent URI. Future requests should use it.
Use for: Permanent URL move; method may change to GET. SEO-safe permanent redirect.
Found
The resource resides temporarily under a different URI. Clients often rewrite POST to GET.
Use for: Temporary redirect where legacy method-rewriting to GET is acceptable.
See Other
The response can be found at another URI using GET.
Use for: Post/Redirect/Get pattern: redirect after a form POST.
Not Modified
The cached representation is still valid; no body is sent.
Use for: Conditional GET with ETag/If-Modified-Since matched.
Use Proxy
The resource must be accessed through a proxy. Deprecated for security reasons.
(Unused)
Reserved. Was 'Switch Proxy' in a draft; no longer used.
Temporary Redirect
Repeat the request at another URI with the same method; the original URI remains canonical.
Use for: Temporary redirect that must preserve the request method and body.
Permanent Redirect
Like 301 but the request method and body must not change.
Use for: Permanent move that must preserve the method (e.g. POST endpoints).
Bad Request
The server cannot process the request due to a client error (malformed syntax, invalid framing).
Use for: Malformed syntax, invalid JSON, bad parameters.
Unauthorized
Authentication is required and has failed or has not been provided.
Use for: Missing or invalid credentials; send WWW-Authenticate.
Payment Required
Reserved for future use; used in practice for quota/billing walls (e.g. API credits exhausted).
Forbidden
The server understood the request but refuses to authorize it.
Use for: Authenticated but not allowed; re-authenticating won't help.
Not Found
The server cannot find the requested resource.
Use for: Resource doesn't exist, or hide its existence from unauthorized users.
Method Not Allowed
The request method is known but not supported by the target resource.
Use for: Wrong verb on a valid route; include an Allow header.
Not Acceptable
No representation matches the request's proactive content negotiation headers (Accept…).
Proxy Authentication Required
Like 401, but authentication is required by a proxy (Proxy-Authenticate).
Request Timeout
The server timed out waiting for the complete request and wants to close the idle connection.
Conflict
The request conflicts with the current state of the resource.
Use for: Version conflicts, duplicate creation, concurrent edit collisions.
Gone
The resource is permanently gone and no forwarding address is known.
Use for: Resource intentionally removed forever (tells crawlers to de-index).
Length Required
The server requires a Content-Length header on the request.
Precondition Failed
One or more request preconditions (If-Match, If-Unmodified-Since…) evaluated false.
Use for: Optimistic locking with If-Match/ETag failed.
Content Too Large
The request body is larger than the server is willing to process (formerly 'Payload Too Large').
Use for: Upload/body exceeds server limits.
URI Too Long
The request URI is longer than the server is willing to interpret.
Unsupported Media Type
The payload format is not supported by the target resource.
Use for: Wrong Content-Type on the request body.
Range Not Satisfiable
The Range header cannot be satisfied (e.g. beyond the end of the resource).
Expectation Failed
The expectation in the request's Expect header could not be met.
I'm a teapot
The server refuses to brew coffee with a teapot. Officially '(Unused)' in RFC 9110.
Page Expired
Laravel: CSRF token missing or expired on a form submission.
Misdirected Request
The request was directed at a server unable to produce a response (e.g. wrong SNI on a reused HTTP/2 connection).
Unprocessable Content
The server understands the content type and syntax but cannot process the contained instructions.
Use for: Syntactically valid but semantically invalid input (validation errors).
Locked
The source or destination resource is locked.
Failed Dependency
The request failed because it depended on another request that failed.
Too Early
The server is unwilling to process a request that might be replayed (TLS early data).
Upgrade Required
The server refuses to perform the request using the current protocol; upgrade per the Upgrade header.
Precondition Required
The origin server requires the request to be conditional.
Use for: Require If-Match to prevent lost-update races.
Too Many Requests
The user has sent too many requests in a given amount of time.
Use for: Rate limiting; include Retry-After.
Request Header Fields Too Large
Header fields (individually or collectively) are too large; e.g. oversized cookies.
Login Time-out
Microsoft IIS: the client's session has expired and must log in again.
No Response
nginx: close the connection without sending a response (logged only, never sent to the client).
Retry With
Microsoft: the request should be retried after performing the appropriate action.
Unavailable For Legal Reasons
Access denied for legal reasons (censorship, DMCA, GDPR territorial blocks).
Client Closed Connection
AWS load balancer: client closed the connection before the idle timeout elapsed.
Too Many Forwarded IPs
AWS load balancer: X-Forwarded-For header with more than 30 IP addresses.
Request Header Too Large
nginx: the request headers exceed the configured buffer size.
SSL Certificate Error
nginx: invalid client certificate presented.
SSL Certificate Required
nginx: a client certificate is required but was not provided.
HTTP Request Sent to HTTPS Port
nginx: plain HTTP request sent to a port listening for HTTPS.
Client Closed Request
nginx: the client closed the connection while the server was still processing the request.
Internal Server Error
The server encountered an unexpected condition that prevented it from fulfilling the request.
Use for: Unexpected server-side failure; the generic fallback.
Not Implemented
The server does not support the functionality required (unrecognized request method).
Bad Gateway
The server, acting as a gateway/proxy, received an invalid response from the upstream server.
Use for: Reverse proxy got an invalid response from upstream.
Service Unavailable
The server is temporarily unable to handle the request (overloaded or down for maintenance).
Use for: Overload or maintenance; include Retry-After.
Gateway Timeout
The gateway/proxy did not receive a timely response from the upstream server.
Use for: Upstream did not respond in time.
HTTP Version Not Supported
The server does not support the HTTP version used in the request.
Variant Also Negotiates
Transparent content negotiation results in a circular reference.
Insufficient Storage
The server cannot store the representation needed to complete the request.
Loop Detected
The server detected an infinite loop while processing the request (Depth: infinity).
Bandwidth Limit Exceeded
Apache bw/limited module & cPanel: the account's bandwidth quota has been exceeded.
Not Extended
Further extensions to the request are required. Obsoleted/Historic.
Network Authentication Required
The client must authenticate to gain network access (captive portals).
Web Server Returned an Unknown Error
Cloudflare: the origin returned an empty, unknown, or unexpected response.
Web Server Is Down
Cloudflare: the origin refused the connection.
Connection Timed Out
Cloudflare: TCP handshake with the origin timed out.
Origin Is Unreachable
Cloudflare: the origin is unreachable (DNS/routing problem).
A Timeout Occurred
Cloudflare: the TCP connection succeeded but the origin did not reply in time.
SSL Handshake Failed
Cloudflare: the TLS handshake with the origin failed.
Invalid SSL Certificate
Cloudflare: could not validate the origin's TLS certificate.
Site Is Overloaded
Qualys SSL Labs: the site cannot process the request right now (overload).
Origin DNS Error
Cloudflare: could not resolve the origin hostname (paired with a 1xxx error code).
Unauthorized
AWS ALB: authentication error from the identity provider during built-in authentication.
Network Read Timeout Error
Some HTTP proxies: network read timeout behind the proxy.
Request Denied
LinkedIn (and others): non-standard catch-all used to deny scrapers/bots.