---
title: "HTTP Status Codes Reference"
description: "The most commonly used HTTP status codes and what they mean. Searchable."
url: https://sade.dev/en/tools/http-status/
lang: en
author: "Muhammet Şafak"
published: 2026-04-08
updated: 2026-08-30
section: Tool
tags: ["http","reference"]
---

# HTTP Status Codes Reference

> The most commonly used HTTP status codes and what they mean. Searchable.

HTTP status codes have three digits; the first digit denotes the class:

- **1xx — Informational**: In progress (rarely seen).
- **2xx — Success**: The request succeeded.
- **3xx — Redirection**: The client needs to take a further step to complete the request.
- **4xx — Client Error**: Something is wrong with the request.
- **5xx — Server Error**: Something is wrong on the server.

## Commonly confused

**401 vs 403**:
- `401 Unauthorized` — "I couldn't verify who you are" (login required).
- `403 Forbidden` — "I know who you are, but you aren't allowed to access this resource".

**422 vs 400**:
- `400 Bad Request` — the server sees a client-side problem, most often malformed syntax
  (e.g. malformed JSON).
- `422 Unprocessable Content` — the syntax is correct but the meaning is invalid (e.g.
  "abc" in an email field). Laravel returns default validation errors with 422 on
  JSON/XHR requests.

**301 vs 308**:
- `301 Moved Permanently` — a permanent redirect. Clients that follow the Fetch Standard
  downgrade a POST to GET, so the method is not preserved.
- `308 Permanent Redirect` — a permanent redirect that **preserves** the method. It
  redirects a POST as a POST.

**502 vs 503 vs 504**:
- `502 Bad Gateway` — the upstream returned an invalid response (e.g. PHP-FPM crash).
- `503 Service Unavailable` — the server is temporarily unable to respond (scheduled
  maintenance, overload).
- `504 Gateway Timeout` — the upstream timed out (a slow worker).

## Idempotency

A method being **idempotent** means that making the same request many times does not
change the side effect:

- `GET`, `PUT`, `DELETE`, `HEAD`, `OPTIONS` — idempotent.
- `POST`, `PATCH` — usually not idempotent.

Idempotent methods **can be retried automatically** after a 5xx error.
Non-idempotent ones (e.g. taking a payment) require mechanisms like an
`Idempotency-Key` header to be retried safely.

## Common anti-patterns

- **Returning an error with `200 OK`** — in a `{"error": "..."}` shape. Bad for REST
  clients; use the status code.
- **Hiding an authorization error behind `404`** — "I don't want to leak whether this
  resource exists". In most cases 403 or 401 is the clearer answer. RFC 9110 does allow a
  404 in place of a 403 to hide a forbidden resource, so make it a deliberate choice
  rather than a habit.
- **`500` everywhere** — there are more descriptive codes (422, 502, 503, 504). 500 is
  only for an unexpected exception.

## Resources

- [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110) — HTTP semantics.
- [MDN HTTP Status Codes](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status).

## Privacy

This is a static reference. Whatever you type to search runs entirely in your browser
and never leaves it — there is no server lookup behind the box.

## Status codes

| Code | Name | Meaning | Common |
| --- | --- | --- | --- |
| 100 | Continue | The client may send the rest of the request. | Large body upload with Expect: 100-continue. |
| 101 | Switching Protocols | The server agreed to switch protocols. | HTTP → WebSocket upgrade. |
| 103 | Early Hints | Early hints sent before the final response. | Early preload for CSS/JS. |
| 200 | OK | The request succeeded. | Standard success response. |
| 201 | Created | A new resource was created. | After a POST, with a Location header. |
| 202 | Accepted | The request was accepted but not yet completed. | Queuing an async job. |
| 204 | No Content | Success with no response body. | DELETE or a successful PUT. |
| 206 | Partial Content | Only the requested byte range was returned. | Video / large file range requests. |
| 301 | Moved Permanently | The resource has moved permanently. | Domain or URL structure changes. |
| 302 | Found | Temporary redirect. | Redirect back after login. |
| 303 | See Other | Redirect to another resource via GET after a POST. | After a form submission. |
| 304 | Not Modified | The cache is still fresh. | ETag / If-None-Match validations. |
| 307 | Temporary Redirect | Temporary redirect that preserves the method. | Method-preserving alternative to 302. |
| 308 | Permanent Redirect | Permanent redirect that preserves the method. | Method-preserving alternative to 301. |
| 400 | Bad Request | The server could not understand the request. | Invalid JSON, missing field. |
| 401 | Unauthorized | Authentication is missing or failed. | Missing / invalid token. |
| 403 | Forbidden | Authenticated but not authorized. | Access to an unauthorized resource. |
| 404 | Not Found | The resource does not exist. | A typical wrong URL. |
| 405 | Method Not Allowed | The HTTP method is not supported. | GET instead of POST, or vice versa. |
| 409 | Conflict | Conflict with the current state. | Concurrent writes, unique constraint. |
| 410 | Gone | The resource was permanently deleted. | Deprecation of an old endpoint. |
| 415 | Unsupported Media Type | The Content-Type is not supported. | Wrong MIME, missing Content-Type. |
| 422 | Unprocessable Content (Unprocessable Entity) | Syntax is valid but the semantics are not. | Validation errors (Laravel default). |
| 429 | Too Many Requests | The rate limit was exceeded. | Rate limiting (Retry-After). |
| 500 | Internal Server Error | An unexpected error on the server. | An uncaught exception. |
| 501 | Not Implemented | The server does not recognize the method. | A beta endpoint. |
| 502 | Bad Gateway | Invalid response from the upstream. | Nginx → PHP-FPM connection issue. |
| 503 | Service Unavailable | The server is temporarily unavailable. | Maintenance mode, overload. |
| 504 | Gateway Timeout | The upstream timed out. | Slow query, stuck worker. |