HTTP Status Codes

The 100 (Continue) status code indicates that the initial part of a request has been received and has not yet been rejected by the server. The server intends to send a final response after the request has been fully received and acted upon.

Reference: RFC 9110

The 101 (Switching Protocols) status code indicates that the server understands and is willing to comply with the client's request, via the Upgrade header field, for a change in the application protocol being used on this connection. The server generate an Upgrade header field in the response that indicates which protocol(s) will be in effect after this response.

Reference: RFC 9110

WebDAV extension: the server has received and is processing the request, but no final response is available yet.

Reference: RFC 2518

Interim response sent before the final response, typically carrying Link headers so the client can preload resources early.

Reference: RFC 8297

Indicates that the server supports resuming an interrupted upload. Temporary IANA registration (expires 2026-11-13).

Reference: draft-ietf-httpbis-resumable-upload

The 200 (OK) status code indicates that the request has succeeded. The content sent in a 200 response depends on the request method.

Reference: RFC 9110

The 201 (Created) status code indicates that the request has been fulfilled and has resulted in one or more new resources being created. The primary resource created by the request is identified by either a Location header field in the response or, if no Location header field is received, by the target URI.

Reference: RFC 9110

The 202 (Accepted) status code indicates that the request has been accepted for processing, but the processing has not been completed. The request might or might not eventually be acted upon, as it might be disallowed when processing actually takes place.

Reference: RFC 9110

The 203 (Non-Authoritative Information) status code indicates that the request was successful but the enclosed content has been modified from that of the origin server's 200 (OK) response by a transforming proxy (Section 7.7). This status code allows the proxy to notify recipients when a transformation has been applied, since that knowledge might impact later decisions regarding the content.

Reference: RFC 9110

The 204 (No Content) status code indicates that the server has successfully fulfilled the request and that there is no additional content to send in the response content.

Reference: RFC 9110

The 205 (Reset Content) status code indicates that the server has fulfilled the request and desires that the user agent reset the "document view", which caused the request to be sent, to its original state as received from the origin server. This response is intended to support a common data entry use case where the user receives content that supports data entry (a form, notepad, canvas, etc.), enters or manipulates data in that space, causes the entered data to be submitted in a request, and then the data entry mechanism is reset for the next entry so that the user can easily initiate another input action.

Reference: RFC 9110

The 206 (Partial Content) status code indicates that the server is successfully fulfilling a range request for the target resource by transferring one or more parts of the selected representation.

Reference: RFC 9110

WebDAV extension: conveys status for multiple independent operations, typically in an XML or JSON response body.

Reference: RFC 4918

WebDAV extension: members of a DAV binding have already been enumerated in a previous reply and are not included again.

Reference: RFC 5842

Apache mod_proxy extension: used internally when a proxy transforms an error response while preserving HTTP 200 semantics.

Reference: Apache

Server has fulfilled a GET request and applied instance manipulations (delta encoding) to the response.

Reference: RFC 3229

The 300 (Multiple Choices) status code indicates that the target resource has more than one representation, each with its own more specific identifier, and information about the alternatives is being provided so that the user (or user agent) can select a preferred representation by redirecting its request to one or more of those identifiers. In other words, the server desires that the user agent engage in reactive negotiation to select the most appropriate representation(s) for its needs.

Reference: RFC 9110

The 301 (Moved Permanently) status code indicates that the target resource has been assigned a new permanent URI and any future references to this resource ought to use one of the enclosed URIs. The server is suggesting that a user agent with link-editing capability can permanently replace references to the target URI with one of the new references sent by the server. However, this suggestion is usually ignored unless the user agent is actively editing references (e.g., engaged in authoring content), the connection is secured, and the origin server is a trusted authority for the content being edited.

Reference: RFC 9110

The 302 (Found) status code indicates that the target resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client ought to continue to use the target URI for future requests.

Reference: RFC 9110

The 303 (See Other) status code indicates that the server is redirecting the user agent to a different resource, as indicated by a URI in the Location header field, which is intended to provide an indirect response to the original request. A user agent can perform a retrieval request targeting that URI (a GET or HEAD request if using HTTP), which might also be redirected, and present the eventual result as an answer to the original request. Note that the new URI in the Location header field is not considered equivalent to the target URI.

Reference: RFC 9110

The 304 (Not Modified) status code indicates that a conditional GET or HEAD request has been received and would have resulted in a 200 (OK) response if it were not for the fact that the condition evaluated to false. In other words, there is no need for the server to transfer a representation of the target resource because the request indicates that the client, which made the request conditional, already has a valid representation.

Reference: RFC 9110

The 305 (Use Proxy) status code was defined in a previous version of this specification and is now deprecated.

Reference: RFC 9110

The 306 status code was defined in a previous version of this specification, is no longer used, and the code is reserved.

Reference: RFC 9110

The 307 (Temporary Redirect) status code indicates that the target resource resides temporarily under a different URI and the user agent MUST NOT change the request method if it performs an automatic redirection to that URI. Since the redirection can change over time, the client ought to continue using the original target URI for future requests.

Reference: RFC 9110

The 308 (Permanent Redirect) status code indicates that the target resource has been assigned a new permanent URI and any future references to this resource ought to use one of the enclosed URIs. The server is suggesting that a user agent with link-editing capability can permanently replace references to the target URI with one of the new references sent by the server.

Reference: RFC 9110

The 400 (Bad Request) status code indicates that the server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).

Reference: RFC 9110

The 401 (Unauthorized) status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. The server generating a 401 response MUST send a WWW-Authenticate header field containing at least one challenge applicable to the target resource.

Reference: RFC 9110

The 402 (Payment Required) status code is reserved for future use.

Reference: RFC 9110

The 403 (Forbidden) status code indicates that the server understood the request but refuses to fulfill it. A server that wishes to make public why the request has been forbidden can describe that reason in the response content (if any). If authentication credentials were provided in the request, the server considers them insufficient to grant access.

Reference: RFC 9110

The 404 (Not Found) status code indicates that the origin server did not find a current representation for the target resource or is not willing to disclose that one exists. A 404 status code does not indicate whether this lack of representation is temporary or permanent.

Reference: RFC 9110

The 405 (Method Not Allowed) status code indicates that the method received in the request-line is known by the origin server but not supported by the target resource. The origin server MUST generate an Allow header field in a 405 response containing a list of the target resource's currently supported methods.

Reference: RFC 9110

The 406 (Not Acceptable) status code indicates that the target resource does not have a current representation that would be acceptable to the user agent, according to the proactive negotiation header fields received in the request, and the server is unwilling to supply a default representation.

Reference: RFC 9110

The 407 (Proxy Authentication Required) status code is similar to 401 (Unauthorized), but it indicates that the client needs to authenticate itself in order to use a proxy for this request. The proxy send a Proxy-Authenticate header field containing a challenge applicable to that proxy for the request. The client repeat the request with a new or replaced Proxy-Authorization header field.

Reference: RFC 9110

The 408 (Request Timeout) status code indicates that the server did not receive a complete request message within the time that it was prepared to wait.

Reference: RFC 9110

The 409 (Conflict) status code indicates that the request could not be completed due to a conflict with the current state of the target resource. This code is used in situations where the user might be able to resolve the conflict and resubmit the request. The server SHOULD generate content that includes enough information for a user to recognize the source of the conflict.

Reference: RFC 9110

The 410 (Gone) status code indicates that access to the target resource is no longer available at the origin server and that this condition is likely to be permanent. If the origin server does not know, or has no facility to determine, whether or not the condition is permanent, the status code 404 (Not Found) ought to be used instead.

Reference: RFC 9110

The 411 (Length Required) status code indicates that the server refuses to accept the request without a defined Content-Length (Section 8.6). The client MAY repeat the request if it adds a valid Content-Length header field containing the length of the request content.

Reference: RFC 9110

The 412 (Precondition Failed) status code indicates that one or more conditions given in the request header fields evaluated to false when tested on the server (Section 13). This response status code allows the client to place preconditions on the current resource state (its current representations and metadata) and, thus, prevent the request method from being applied if the target resource is in an unexpected state.

Reference: RFC 9110

The 413 (Content Too Large) status code indicates that the server is refusing to process a request because the request content is larger than the server is willing or able to process. The server terminate the request, if the protocol version in use allows it; otherwise, the server close the connection.

Reference: RFC 9110

The 414 (URI Too Long) status code indicates that the server is refusing to service the request because the target URI is longer than the server is willing to interpret. This rare condition is only likely to occur when a client has improperly converted a POST request to a GET request with long query information, when the client has descended into an infinite loop of redirection (e.g., a redirected URI prefix that points to a suffix of itself) or when the server is under attack by a client attempting to exploit potential security holes.

Reference: RFC 9110

The 415 (Unsupported Media Type) status code indicates that the origin server is refusing to service the request because the content is in a format not supported by this method on the target resource.

Reference: RFC 9110

The 416 (Range Not Satisfiable) status code indicates that the set of ranges in the request's Range header field (Section 14.2) has been rejected either because none of the requested ranges are satisfiable or because the client has requested an excessive number of small or overlapping ranges (a potential denial of service attack).

Reference: RFC 9110

The 417 (Expectation Failed) status code indicates that the expectation given in the request's Expect header field could not be met by at least one of the inbound servers.

Reference: RFC 9110

RFC2324 was an April 1 RFC that lampooned the various ways HTTP was abused; one such abuse was the definition of an application-specific 418 status code, which has been deployed as a joke often enough for the code to be unusable for any future use.

Reference: RFC 7168

Laravel framework convention for CSRF token mismatch or expired session, often surfaced during form resubmission.

Reference: Laravel

Twitter/X rate-limiting response indicating the client is sending too many requests.

Reference: Twitter/X

Spring Framework and some WebDAV implementations use this for method failure. Conflicts with Twitter's 420 usage.

Reference: Spring Framework

The 421 (Misdirected Request) status code indicates that the request was directed at a server that is unable or unwilling to produce an authoritative response for the target URI. An origin server (or gateway acting on behalf of the origin server) sends 421 to reject a target URI that does not match an origin for which the server has been configured or does not match the connection context over which the request was received.

Reference: RFC 9110

The 422 (Unprocessable Content) status code indicates that the server understands the content type of the request content (hence a 415 (Unsupported Media Type) status code is inappropriate), and the syntax of the request content is correct, but it was unable to process the contained instructions. For example, this status code can be sent if an XML request content contains wellformed (i.e., syntactically correct), but semantically erroneous XML instructions.

Reference: RFC 9110

WebDAV extension: resource is locked and the requested method cannot be applied.

Reference: RFC 4918

WebDAV extension: request failed because it depended on another request that failed.

Reference: RFC 4918

Server is unwilling to process a request that might be replayed, mitigating early-data (0-RTT) TLS risks.

Reference: RFC 8470

The 426 (Upgrade Required) status code indicates that the server refuses to perform the request using the current protocol but might be willing to do so after the client upgrades to a different protocol. The server MUST send an Upgrade header field in a 426 response to indicate the required protocol(s).

Reference: RFC 9110

Origin server requires the request to be conditional, typically to prevent lost-update problems.

Reference: RFC 6585

Client has sent too many requests in a given time window. A Retry-After header may indicate when to retry.

Reference: RFC 6585

Non-standard code used by some servers before RFC 6585 standardized 431 for oversized request headers.

Reference: Various

Server refuses to process the request because a single header field or the total header size is too large.

Reference: RFC 6585

Microsoft IIS extension: client's session has expired and must log in again.

Reference: Microsoft IIS

Nginx extension: server closes the connection without sending a response, typically to save resources from malicious clients.

Reference: nginx

Microsoft IIS extension: client should retry after performing an action, such as resubmitting with additional information.

Reference: Microsoft IIS

Microsoft extension indicating content was blocked by Windows Parental Controls.

Reference: Microsoft

Server is denying access to the resource for legal reasons, such as censorship or DMCA takedown.

Reference: RFC 7725

AWS Elastic Load Balancing extension: client closed the connection before the idle timeout period elapsed.

Reference: AWS ELB

AWS extension: client exceeded a request rate limit enforced by the load balancer or WAF.

Reference: AWS

Nginx extension: request headers exceed the configured buffer size.

Reference: nginx

Nginx extension: client presented an invalid SSL certificate.

Reference: nginx

Nginx extension: client must present a valid SSL certificate.

Reference: nginx

Nginx extension: plain HTTP request was sent to an HTTPS-only port.

Reference: nginx

Esri ArcGIS extension: token expired or is otherwise invalid.

Reference: Esri

Nginx extension: client closed the connection before the server could send a response.

Reference: nginx

The 500 (Internal Server Error) status code indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.

Reference: RFC 9110

The 501 (Not Implemented) status code indicates that the server does not support the functionality required to fulfill the request. This is the appropriate response when the server does not recognize the request method and is not capable of supporting it for any resource.

Reference: RFC 9110

Server acting as a gateway or proxy received an invalid response from an upstream server.

Reference: RFC 9110

Server is temporarily unable to handle the request, often due to overload or maintenance. Retry-After may be set.

Reference: RFC 9110

Server acting as a gateway or proxy did not receive a timely response from an upstream server.

Reference: RFC 9110

Server does not support the HTTP version used in the request.

Reference: RFC 9110

Transparent content negotiation resulted in a circular reference among variant choices.

Reference: RFC 2295

WebDAV extension: server cannot store the representation needed to complete the request.

Reference: RFC 4918

WebDAV extension: server detected an infinite loop while processing a request with Depth: infinity.

Reference: RFC 5842

Apache extension (often via cPanel): site has exceeded its configured bandwidth allocation.

Reference: Apache / cPanel

Further extensions to the request are required. Obsoleted; HTTP extension framework experiments are now historic.

Reference: RFC 2774

Client must authenticate to the network before gaining access, commonly used by captive portals.

Reference: RFC 6585

Cloudflare extension: origin returned an empty, unknown, or unexpected response that Cloudflare could not interpret.

Reference: Cloudflare

Cloudflare extension: connection to the origin web server was refused.

Reference: Cloudflare

Cloudflare extension: TCP connection to the origin server timed out.

Reference: Cloudflare

Cloudflare extension: origin server could not be reached, often due to DNS or routing issues.

Reference: Cloudflare

Cloudflare extension: TCP connection was established but the origin did not respond with an HTTP response in time.

Reference: Cloudflare

Cloudflare extension: SSL/TLS handshake with the origin server failed.

Reference: Cloudflare

Cloudflare extension: origin SSL certificate is invalid, expired, or not trusted.

Reference: Cloudflare

Cloudflare extension: connection to the Railgun listener failed or timed out.

Reference: Cloudflare

Cloudflare extension: origin or edge is overloaded and unable to serve the request.

Reference: Cloudflare

Cloudflare and Pinterest extension: site is temporarily unavailable, frozen, or blocked.

Reference: Cloudflare / Pinterest

Informal code used by some proxies and load balancers when a network read operation times out.

Reference: Various

Informal code used by some proxies and load balancers when a network connection attempt times out.

Reference: Various