100
Continue
The initial part of the request has been received and the client should continue sending the rest, such as the request body.
RFC 9110HTTP Status Codes
A free, interactive HTTP status code list and cheat sheet. Every REST API code from 100 to 599, plus unofficial nginx, Cloudflare, and AWS codes, in plain English. Click any code to copy it, or share a direct link.
1xx Informational
Interim responses. The server received the request and the client should continue.
101
Switching Protocols
The server is switching protocols as requested by the client via the Upgrade header. Most commonly seen when opening a WebSocket connection.
RFC 9110102
Processing
The server has accepted the full request but has not yet completed it (WebDAV). Deprecated and rarely seen today.
RFC 2518103
Early Hints
Used to return preload or preconnect hints before the final response, so browsers can start fetching critical resources early.
RFC 82972xx Success
The request was received, understood, and accepted.
200
OK
The request succeeded. The meaning of success depends on the HTTP method: GET returns the resource, POST reports the result of the action.
RFC 9110201
Created
The request succeeded and a new resource was created as a result. The Location header usually points to the new resource.
RFC 9110202
Accepted
The request has been received but not acted upon yet. Common for asynchronous jobs and queued processing.
RFC 9110203
Non-Authoritative Information
The returned meta-information is from a cached or transforming proxy, not the origin server itself.
RFC 9110204
No Content
The server processed the request but is not returning any content. Common for DELETE requests and save actions that need no response body.
RFC 9110205
Reset Content
Instructs the client to reset the document view that sent the request, such as clearing a submitted form.
RFC 9110206
Partial Content
The server is delivering only part of the resource due to a Range header. Used for download resumption and video streaming.
RFC 9110207
Multi-Status
Conveys information about multiple independent operations, each with its own status code (WebDAV).
RFC 4918208
Already Reported
The members of a DAV binding have already been enumerated in an earlier part of the response (WebDAV).
RFC 5842226
IM Used
The server fulfilled a GET request and the response represents the result of one or more instance manipulations, such as a delta update.
RFC 32293xx Redirection
Further action is needed, usually following a redirect to another URL.
300
Multiple Choices
The request has more than one possible response. The client or user should choose one of them.
RFC 9110301
Moved Permanently
The URL of the requested resource has been changed permanently. Browsers cache this redirect and search engines transfer ranking signals to the new URL.
RFC 9110302
Found
The resource is temporarily at a different URL. Search engines keep the original URL indexed, so use 301 or 308 for permanent moves.
RFC 9110303
See Other
The response can be found at another URL using a GET request. Often used after a POST so a page refresh does not resubmit the form.
RFC 9110304
Not Modified
The client’s cached copy is still valid and can be reused. Sent in response to conditional requests with If-None-Match or If-Modified-Since headers.
RFC 9110305
Use Proxy
Deprecated. The requested resource must be accessed through the specified proxy. No longer used due to security concerns.
RFC 9110306
(Unused)
Reserved. It was defined as Switch Proxy in an early draft and is no longer used, but the number remains reserved.
RFC 9110307
Temporary Redirect
The resource is temporarily at another URL. Unlike 302, the request method and body must not change when following the redirect.
RFC 9110308
Permanent Redirect
The resource has permanently moved. Like 301, but the request method and body must not change when following the redirect.
RFC 91104xx Client Errors
The request contains an error or cannot be fulfilled as sent.
400
Bad Request
The server cannot process the request due to a client error. Check the request syntax, query parameters, and JSON body for mistakes.
RFC 9110401
Unauthorized
Authentication is required and has failed or has not been provided. Retry with a valid Authorization header, such as a fresh token or login.
RFC 9110402
Payment Required
Reserved for future use. In practice some APIs use it to signal that payment is needed or a quota has been exceeded.
RFC 9110403
Forbidden
The client is known but does not have permission to access the resource. Unlike 401, authenticating again will not help.
RFC 9110404
Not Found
The server cannot find the requested resource. Check the URL for typos. APIs may also use it to hide resources from unauthorized clients.
RFC 9110405
Method Not Allowed
The request method is known but not supported by this resource, such as sending POST to a GET-only endpoint. The Allow header lists supported methods.
RFC 9110406
Not Acceptable
No available representation matches the client’s Accept headers, such as requesting XML from a JSON-only API.
RFC 9110407
Proxy Authentication Required
Authentication with the proxy is required before the request can proceed. The proxy equivalent of 401.
RFC 9110408
Request Timeout
The server timed out waiting for the request. Often caused by slow networks or a client holding a connection open without sending data.
RFC 9110409
Conflict
The request conflicts with the current state of the resource. Typical for version conflicts, duplicate submissions, or concurrent edits.
RFC 9110410
Gone
The resource has been permanently removed and no forwarding address is known. A stronger signal than 404 for search engines to deindex a page.
RFC 9110411
Length Required
The server requires a Content-Length header, which the request did not supply.
RFC 9110412
Precondition Failed
One or more conditions in the request headers, such as If-Match, evaluated to false. Used to prevent lost updates in concurrent editing.
RFC 9110413
Content Too Large
The request body is larger than the server accepts. Often an upload exceeding a size limit, such as client_max_body_size in nginx. Formerly called Payload Too Large.
RFC 9110414
URI Too Long
The URI is longer than the server can interpret, usually a query string that has grown out of control.
RFC 9110415
Unsupported Media Type
The media format of the request body is not supported by the resource. Check the Content-Type header on the request.
RFC 9110416
Range Not Satisfiable
The requested byte range cannot be fulfilled, for example a range beyond the end of the file.
RFC 9110417
Expectation Failed
The expectation given in the Expect request header cannot be met by the server.
RFC 9110418
I'm a teapot
The server refuses to brew coffee because it is, permanently, a teapot. An April Fools’ joke from 1998 that stuck around.
RFC 2324421
Misdirected Request
The request was directed at a server that cannot produce a response, often a TLS or HTTP/2 connection reuse issue.
RFC 9110422
Unprocessable Content
The request was well-formed but contains semantic errors. Common in REST APIs when a field fails validation. Formerly called Unprocessable Entity.
RFC 9110423
424
Failed Dependency
The request failed because a previous request it depended on also failed (WebDAV).
RFC 4918425
Too Early
The server is unwilling to risk processing a request that might be replayed, related to TLS 1.3 early data.
RFC 8470426
Upgrade Required
The client must switch to a different protocol, given in the Upgrade header, to continue.
RFC 9110428
Precondition Required
The origin server requires the request to be conditional, to prevent lost updates when multiple clients edit the same resource.
RFC 6585429
Too Many Requests
The client has sent too many requests in a given amount of time. Slow down and retry after the time given in the Retry-After header.
RFC 6585431
Request Header Fields Too Large
The request headers are too large for the server to process. Oversized cookies are the most common cause.
RFC 6585451
Unavailable For Legal Reasons
The resource cannot legally be provided, often due to censorship, court order, or a takedown request. The number references Fahrenheit 451.
RFC 77255xx Server Errors
The server failed to fulfill a valid request.
500
Internal Server Error
A generic server error when no more specific 5xx code fits. Check the server logs for the underlying exception.
RFC 9110501
Not Implemented
The request method is not supported by the server and cannot be handled at all, such as an unrecognized HTTP verb.
RFC 9110502
Bad Gateway
The server, acting as a gateway, received an invalid response from the upstream server. Common with reverse proxies when the backend crashes.
RFC 9110503
Service Unavailable
The server is not ready to handle the request. Usually temporary: planned maintenance, an overloaded server, or a backend marked unhealthy.
RFC 9110504
Gateway Timeout
The gateway did not receive a timely response from the upstream server. Check upstream timeout settings and long-running requests.
RFC 9110505
HTTP Version Not Supported
The HTTP version used in the request is not supported by the server.
RFC 9110506
Variant Also Negotiates
Transparent content negotiation resulted in a circular reference. A server configuration error.
RFC 2295507
Insufficient Storage
The server cannot store the representation needed to complete the request (WebDAV).
RFC 4918508
510
Not Extended
Further extensions to the request are required for the server to fulfill it. Historic and rarely seen.
RFC 2774511
Network Authentication Required
The client needs to authenticate to gain network access. Shown by captive portals on hotel, airport, and cafe Wi-Fi.
RFC 6585Unofficial & Server-Specific
Non-standard codes returned by nginx, Cloudflare, AWS, and other platforms. Not part of the official IANA registry.
419
Page Expired
Returned by Laravel when a CSRF token is missing or expired. Refresh the page and submit the form again.
420
Enhance Your Calm
Returned by the original Twitter API when a client was rate limited. Retired in favor of the standard 429.
444
No Response
An nginx-specific code that closes the connection without sending any response. Used to drop malicious or unwanted requests.
460
Client Closed Connection
An AWS load balancer code. The client closed the connection before the load balancer received a full response, often a client timeout set too low.
463
Too Many Forwarded IPs
An AWS load balancer code. The X-Forwarded-For header contained more than 30 IP addresses.
494
Request Header Too Large
The nginx equivalent of 431. The request line or a header field exceeded the configured header buffer size.
495
SSL Certificate Error
An nginx code: the client sent an invalid certificate during client certificate authentication.
496
SSL Certificate Required
An nginx code: a required client certificate was not provided with the request.
497
HTTP Request Sent to HTTPS Port
An nginx code: a plain HTTP request was sent to a port listening for HTTPS. Usually a scheme or port misconfiguration.
499
Client Closed Request
An nginx code: the client closed the connection before the server finished responding. Usually an impatient client, a low proxy timeout, or users navigating away.
509
Bandwidth Limit Exceeded
The site exceeded its hosting bandwidth quota. Common on shared cPanel and Apache hosting.
520
Web Server Returned an Unknown Error
A Cloudflare code: the origin returned an empty, malformed, or unexpected response. Check the origin server logs.
521
Web Server Is Down
A Cloudflare code: Cloudflare could not connect to the origin server. The origin is offline or blocking Cloudflare IP addresses.
522
Connection Timed Out
A Cloudflare code: the TCP handshake with the origin timed out. Often firewall rules or an overloaded origin server.
523
Origin Is Unreachable
A Cloudflare code: Cloudflare could not route to the origin, most often a DNS or network configuration problem.
524
A Timeout Occurred
A Cloudflare code: the connection to the origin succeeded but no HTTP response arrived in time. Long-running requests are the usual cause.
525
SSL Handshake Failed
A Cloudflare code: the TLS handshake between Cloudflare and the origin failed. Check the origin certificate and SSL settings.
526
Invalid SSL Certificate
A Cloudflare code: the origin certificate was rejected, usually expired or self-signed while SSL mode is set to Full (strict).
527
Railgun Error
A legacy Cloudflare code from the retired Railgun service, signaling a failed connection between Railgun components.
530
Origin DNS Error
A Cloudflare code shown with an accompanying 1xxx error. Most often the origin hostname could not be resolved in DNS.