HTTP Status Code Lookup

71 status codes

• 100Continue

  The server received the request headers and the client should send the body. Sent in reply to Expect: 100-continue, so large uploads can be rejected before they're sent.

  InformationalRFC 9110HttpStatus.CONTINUE

• 101Switching Protocols

  The server is switching to the protocol the client asked for in the Upgrade header, most often WebSocket.

  InformationalRFC 9110HttpStatus.SWITCHING_PROTOCOLS

• 102ProcessingDeprecated

  WebDAV: the server is still working on a long request, to stop the client timing out. Removed from later WebDAV specs.

  InformationalRFC 2518HttpStatus.PROCESSING

• 103Early Hints

  Sent before the final response with Link headers, so the browser can start preloading stylesheets and scripts while the server prepares the page.

  InformationalRFC 8297HttpStatus.EARLY_HINTS

• 200OK

  The request succeeded. The body contains the result: the resource for GET, the outcome for POST.

  SuccessRFC 9110HttpStatus.OK

• 201Created

  A new resource was created, typically by POST or PUT. Include a Location header with its URL.

  SuccessRFC 9110HttpStatus.CREATED

• 202Accepted

  The request was accepted for processing, but isn't finished (e.g. queued as a background job). Often returned with a link to check the job's status.

  SuccessRFC 9110HttpStatus.ACCEPTED

• 203Non-Authoritative Information

  Success, but a proxy modified the response from the origin server.

  SuccessRFC 9110HttpStatus.NON_AUTHORITATIVE_INFORMATION

• 204No Content

  Success with no body. Common for DELETE, and for PUT or PATCH when the updated resource isn't returned.

  SuccessRFC 9110HttpStatus.NO_CONTENT

• 205Reset Content

  Success; the client should reset the form or view that sent the request. Rarely used.

  SuccessRFC 9110HttpStatus.RESET_CONTENT

• 206Partial Content

  The body is only part of the resource, as requested by a Range header. Used for resumable downloads and video seeking.

  SuccessRFC 9110HttpStatus.PARTIAL_CONTENT

• 207Multi-Status

  WebDAV: the body (usually XML) holds a separate status for each of several resources.

  SuccessRFC 4918HttpStatus.MULTI_STATUS

• 208Already Reported

  WebDAV: members of a binding were already listed earlier in the same Multi-Status response.

  SuccessRFC 5842HttpStatus.ALREADY_REPORTED

• 226IM Used

  The response is the result of instance manipulations (delta encoding) applied to the resource. Rarely seen.

  SuccessRFC 3229HttpStatus.IM_USED

• 300Multiple Choices

  Several representations are available and the client (or user) should choose one. Rarely used in practice.

  RedirectionRFC 9110HttpStatus.MULTIPLE_CHOICES

• 301Moved Permanently

  A permanent redirect: the resource has a new URL, given in Location. Search engines move ranking to the new URL; browsers cache it. Clients may change POST to GET when following it; use 308 to keep the method.

  RedirectionRFC 9110HttpStatus.MOVED_PERMANENTLY

• 302Found

  A temporary redirect to another URL (Location). Clients may change POST to GET when following it; use 307 to keep the method, or 303 to require GET.

  RedirectionRFC 9110HttpStatus.FOUND

• 303See Other

  Fetch the result with GET at another URL. The classic Post/Redirect/Get pattern after a form submission.

  RedirectionRFC 9110HttpStatus.SEE_OTHER

• 304Not Modified

  Reply to a conditional request (If-None-Match or If-Modified-Since): the cached copy is still valid, so no body is sent.

  RedirectionRFC 9110HttpStatus.NOT_MODIFIED

• 305Use ProxyDeprecated

  Deprecated for security reasons: told the client to use a proxy. Don't use it.

  RedirectionRFC 9110HttpStatus.USE_PROXY

• 307Temporary Redirect

  The resource is temporarily at another URL, and the client must repeat the request with the same method and body.

  RedirectionRFC 9110HttpStatus.TEMPORARY_REDIRECT

• 308Permanent Redirect

  Like 301, but the method and body must not change, so a POST stays a POST.

  RedirectionRFC 9110HttpStatus.PERMANENT_REDIRECT

• 400Bad Request

  The request is malformed: invalid JSON, a missing required parameter, a bad value. Don't retry without changing it. Spring returns it for failed @Valid validation and unreadable bodies.

  Client errorRFC 9110HttpStatus.BAD_REQUEST

• 401Unauthorized

  Authentication is missing or invalid, e.g. no token, or an expired one. Must include WWW-Authenticate. Despite the name it's about authentication; use 403 when the user is known but not allowed.

  Client errorRFC 9110HttpStatus.UNAUTHORIZED

• 402Payment Required

  Reserved for future use; some APIs use it when a subscription or quota has to be paid for.

  Client errorRFC 9110HttpStatus.PAYMENT_REQUIRED

• 403Forbidden

  The server knows who you are but won't allow this, e.g. a missing role or scope. Logging in again won't help. Also what Spring Security returns for a failed CSRF check.

  Client errorRFC 9110HttpStatus.FORBIDDEN

• 404Not Found

  Nothing exists at this URL, or the server won't say whether it does (hiding a resource from users who may not see it).

  Client errorRFC 9110HttpStatus.NOT_FOUND

• 405Method Not Allowed

  The URL exists but doesn't support this method, e.g. DELETE on a read-only endpoint. The Allow header lists the methods that work.

  Client errorRFC 9110HttpStatus.METHOD_NOT_ALLOWED

• 406Not Acceptable

  The server can't produce any format listed in the Accept header, e.g. only JSON is available but the client asked for XML.

  Client errorRFC 9110HttpStatus.NOT_ACCEPTABLE

• 407Proxy Authentication Required

  Like 401, but the proxy in between needs credentials (Proxy-Authenticate / Proxy-Authorization).

  Client errorRFC 9110HttpStatus.PROXY_AUTHENTICATION_REQUIRED

• 408Request Timeout

  The client took too long to send the request, so the server closed the connection. Safe to retry.

  Client errorRFC 9110HttpStatus.REQUEST_TIMEOUT

• 409Conflict

  The request conflicts with the resource's current state: a duplicate username, an edit based on a stale version (optimistic locking), a unique constraint.

  Client errorRFC 9110HttpStatus.CONFLICT

• 410Gone

  The resource existed but was removed on purpose and won't come back. Search engines drop it faster than a 404.

  Client errorRFC 9110HttpStatus.GONE

• 411Length Required

  The server requires a Content-Length header.

  Client errorRFC 9110HttpStatus.LENGTH_REQUIRED

• 412Precondition Failed

  A condition in the request headers wasn't met, typically If-Match with an outdated ETag: someone else changed the resource first.

  Client errorRFC 9110HttpStatus.PRECONDITION_FAILED

• 413Content Too Large

  The body is bigger than the server accepts, e.g. an upload over nginx's client_max_body_size or Spring's spring.servlet.multipart.max-file-size.

  Client errorRFC 9110HttpStatus.PAYLOAD_TOO_LARGE

• 414URI Too Long

  The URL is longer than the server will handle, often a GET with a huge query string that should be a POST.

  Client errorRFC 9110HttpStatus.URI_TOO_LONG

• 415Unsupported Media Type

  The body's format isn't accepted, usually a missing or wrong Content-Type, e.g. JSON sent without Content-Type: application/json.

  Client errorRFC 9110HttpStatus.UNSUPPORTED_MEDIA_TYPE

• 416Range Not Satisfiable

  The Range header asks for bytes outside the resource.

  Client errorRFC 9110HttpStatus.REQUESTED_RANGE_NOT_SATISFIABLE

• 417Expectation Failed

  The server can't meet the Expect header, usually Expect: 100-continue.

  Client errorRFC 9110HttpStatus.EXPECTATION_FAILED

• 418I'm a teapot

  An April Fools' joke (the Hyper Text Coffee Pot Control Protocol): the server refuses to brew coffee because it's a teapot. Reserved, and sometimes used for requests a server deliberately refuses.

  Client errorRFC 2324HttpStatus.I_AM_A_TEAPOT

• 421Misdirected Request

  The request reached a server that can't answer for this host, e.g. an HTTP/2 connection reused for a domain its certificate covers but the server doesn't serve.

  Client errorRFC 9110

• 422Unprocessable Content

  The request is well-formed but semantically invalid, e.g. valid JSON that fails business rules. Many APIs use it for validation errors instead of 400.

  Client errorRFC 9110HttpStatus.UNPROCESSABLE_ENTITY

• 423Locked

  WebDAV: the resource is locked.

  Client errorRFC 4918HttpStatus.LOCKED

• 424Failed Dependency

  WebDAV: the request failed because an earlier request it depended on failed.

  Client errorRFC 4918HttpStatus.FAILED_DEPENDENCY

• 425Too Early

  The server won't process a request sent as TLS early data (0-RTT), because it might be replayed.

  Client errorRFC 8470HttpStatus.TOO_EARLY

• 426Upgrade Required

  The client must switch to another protocol (given in Upgrade), e.g. a newer TLS or HTTP version.

  Client errorRFC 9110HttpStatus.UPGRADE_REQUIRED

• 428Precondition Required

  The server requires conditional requests (If-Match) to prevent lost updates, and this one had none.

  Client errorRFC 6585HttpStatus.PRECONDITION_REQUIRED

• 429Too Many Requests

  Rate limit exceeded. Retry after the time given in Retry-After, ideally with exponential backoff.

  Client errorRFC 6585HttpStatus.TOO_MANY_REQUESTS

• 431Request Header Fields Too Large

  The headers are too big, most often too many or too large cookies, or a huge JWT in Authorization.

  Client errorRFC 6585HttpStatus.REQUEST_HEADER_FIELDS_TOO_LARGE

• 444No ResponseUnofficial · nginx

  nginx closed the connection without sending anything, typically to drop unwanted or malicious requests. Only visible in nginx's logs.

  Client errornginx

• 451Unavailable For Legal Reasons

  Blocked for legal reasons, such as a court order or government censorship. Named after Fahrenheit 451.

  Client errorRFC 7725HttpStatus.UNAVAILABLE_FOR_LEGAL_REASONS

• 499Client Closed RequestUnofficial · nginx

  nginx: the client closed the connection before the server answered, e.g. the user navigated away or a client timeout was shorter than the backend's response time.

  Client errornginx

• 500Internal Server Error

  An unexpected error on the server, typically an unhandled exception. Check the server logs for the stack trace.

  Server errorRFC 9110HttpStatus.INTERNAL_SERVER_ERROR

• 501Not Implemented

  The server doesn't support the functionality needed, e.g. an HTTP method it doesn't recognize.

  Server errorRFC 9110HttpStatus.NOT_IMPLEMENTED

• 502Bad Gateway

  A proxy or gateway (nginx, a load balancer, an API gateway) got an invalid response from the upstream server, often because it crashed or closed the connection. Usually safe to retry.

  Server errorRFC 9110HttpStatus.BAD_GATEWAY

• 503Service Unavailable

  The server is temporarily unable to handle requests: overloaded, down for maintenance, or no healthy backends. Retry later, respecting Retry-After.

  Server errorRFC 9110HttpStatus.SERVICE_UNAVAILABLE

• 504Gateway Timeout

  A proxy or gateway didn't get a response from the upstream server in time, e.g. a slow database query behind nginx's proxy_read_timeout.

  Server errorRFC 9110HttpStatus.GATEWAY_TIMEOUT

• 505HTTP Version Not Supported

  The server doesn't support the HTTP version of the request.

  Server errorRFC 9110HttpStatus.HTTP_VERSION_NOT_SUPPORTED

• 506Variant Also Negotiates

  A content negotiation configuration error on the server. Rarely seen.

  Server errorRFC 2295HttpStatus.VARIANT_ALSO_NEGOTIATES

• 507Insufficient Storage

  WebDAV: the server can't store what's needed to complete the request.

  Server errorRFC 4918HttpStatus.INSUFFICIENT_STORAGE

• 508Loop Detected

  WebDAV: the server found an infinite loop while processing the request.

  Server errorRFC 5842HttpStatus.LOOP_DETECTED

• 510Not ExtendedDeprecated

  Further extensions to the request are required. Obsolete.

  Server errorRFC 2774HttpStatus.NOT_EXTENDED

• 511Network Authentication Required

  You need to sign in to the network first, e.g. a hotel or airport Wi-Fi captive portal.

  Server errorRFC 6585HttpStatus.NETWORK_AUTHENTICATION_REQUIRED

• 520Web Server Returned an Unknown ErrorUnofficial · Cloudflare

  Cloudflare: the origin server returned an empty, unknown or unexpected response.

  Server errorCloudflare

• 521Web Server Is DownUnofficial · Cloudflare

  Cloudflare: the origin server refused the connection. The server is down or a firewall blocks Cloudflare's IP ranges.

  Server errorCloudflare

• 522Connection Timed OutUnofficial · Cloudflare

  Cloudflare couldn't establish a TCP connection to the origin in time: the origin is overloaded or unreachable.

  Server errorCloudflare

• 523Origin Is UnreachableUnofficial · Cloudflare

  Cloudflare can't reach the origin, often because of wrong DNS records or network routing problems.

  Server errorCloudflare

• 524A Timeout OccurredUnofficial · Cloudflare

  Cloudflare connected to the origin, but it didn't send a response within 100 seconds (by default). Move long work to a background job.

  Server errorCloudflare

• 525SSL Handshake FailedUnofficial · Cloudflare

  Cloudflare couldn't complete a TLS handshake with the origin, e.g. no certificate or unsupported ciphers.

  Server errorCloudflare

• 526Invalid SSL CertificateUnofficial · Cloudflare

  With Full (strict) SSL, Cloudflare couldn't validate the origin's certificate: expired, self-signed or for another hostname.

  Server errorCloudflare