Reference
HTTP status codes and headers, explained
What each code and header means, what your client should do next, when to retry, and what security teams look for.
Status codes
1xx Informational
2xx Success
200 OK
The request succeeded.
201 Created
A new resource was created.
202 Accepted
The request was accepted for processing, which has not finished.
203 Non-Authoritative Information
A proxy modified the successful response.
204 No Content
The request succeeded and there is no body.
205 Reset Content
Success; the client should reset the view that sent the request.
206 Partial Content
Only the requested byte range is returned.
207 Multi-Status
The body contains separate statuses for several operations.
208 Already Reported
WebDAV: members were already listed earlier in this response.
226 IM Used
The response is the result of instance manipulations applied to the resource.
3xx Redirection
300 Multiple Choices
Several representations are available; choose one.
301 Moved Permanently
The resource has a new permanent URL.
302 Found
The resource is temporarily at another URL.
303 See Other
Fetch the result from another URL with GET.
304 Not Modified
Your cached copy is still valid.
307 Temporary Redirect
Repeat the same request at another URL, temporarily.
308 Permanent Redirect
Repeat the same request at a new permanent URL.
4xx Client error
400 Bad Request
The server cannot process the request as sent.
401 Unauthorized
Authentication is missing or invalid.
402 Payment Required
Reserved; some APIs use it for billing or quota problems.
403 Forbidden
You are authenticated but not allowed to do this.
404 Not Found
No resource exists at this URL (or you may not see it).
405 Method Not Allowed
This URL does not support the HTTP method you used.
406 Not Acceptable
The server cannot produce a format listed in your Accept header.
407 Proxy Authentication Required
A proxy between you and the server needs credentials.
408 Request Timeout
The server gave up waiting for the request.
409 Conflict
The request conflicts with the current state of the resource.
410 Gone
The resource existed but has been permanently removed.
411 Length Required
The server requires a Content-Length header.
412 Precondition Failed
A conditional header did not match.
413 Content Too Large
The request body exceeds the server limit.
414 URI Too Long
The URL is longer than the server accepts.
415 Unsupported Media Type
The server does not accept this body format.
416 Range Not Satisfiable
The requested byte range is outside the resource.
417 Expectation Failed
The server cannot meet the Expect header.
418 I'm a teapot
An April Fools joke status from RFC 2324.
421 Misdirected Request
The request reached a server that cannot answer for this host.
422 Unprocessable Content
The body is well-formed but semantically invalid.
423 Locked
The resource is locked.
424 Failed Dependency
The request failed because a request it depended on failed.
425 Too Early
The server will not process a request that might be replayed.
426 Upgrade Required
Switch to a different protocol to continue.
428 Precondition Required
The server requires a conditional request.
429 Too Many Requests
You hit a rate limit.
431 Request Header Fields Too Large
One header, or all headers together, are too large.
451 Unavailable For Legal Reasons
Access is blocked for legal reasons.
5xx Server error
500 Internal Server Error
The server hit an unexpected error.
501 Not Implemented
The server does not support this functionality.
502 Bad Gateway
A gateway or proxy got an invalid response from the upstream server.
503 Service Unavailable
The server is temporarily unable to handle the request.
504 Gateway Timeout
A gateway did not get an upstream response in time.
505 HTTP Version Not Supported
The server does not support this HTTP version.
506 Variant Also Negotiates
Server configuration error in content negotiation.
507 Insufficient Storage
The server cannot store what is needed to complete the request.
508 Loop Detected
The server found an infinite loop while processing.
510 Not Extended
Further extensions to the request are required.
511 Network Authentication Required
You need to sign in to the network first.
Headers
Accept
Media types the client can handle in the response.
Accept-Encoding
Compression formats the client understands.
Accept-Language
Preferred human languages for the response.
Access-Control-Allow-Credentials
Whether the browser may expose the response when the request carried cookies or auth.
Access-Control-Allow-Headers
Request headers a cross-origin page may send.
Access-Control-Allow-Methods
Methods a cross-origin page may use.
Access-Control-Allow-Origin
Which web origin may read this response from browser JavaScript.
Access-Control-Expose-Headers
Response headers that cross-origin JavaScript may read.
Access-Control-Max-Age
How long the browser may cache a preflight result, in seconds.
Age
Seconds the response has spent in a shared cache.
Allow
Methods the resource supports.
Authorization
Credentials for the request.
Cache-Control
Caching rules for browsers, proxies and CDNs.
Connection
Options for the current connection only.
Content-Disposition
Whether to display the body inline or download it, and the file name.
Content-Encoding
Compression applied to the body.
Content-Length
Body size in bytes.
Content-Range
Which bytes of the full resource this partial body holds.
Content-Security-Policy
Restricts what a browser page may load and run.
Content-Type
Media type of the body.
Cookie
Cookies the browser stored for this site.
Cross-Origin-Resource-Policy
Which origins may embed this resource.
Date
When the response was generated.
ETag
An identifier for this exact version of the resource.
Expires
Absolute time after which the response is stale.
Idempotency-Key
A unique key that makes retries of a non-idempotent request safe.
If-Match
Only perform the change if the resource still has this ETag.
If-Modified-Since
Only send the body if it changed after this date.
If-None-Match
Only send the body if the ETag differs.
Last-Modified
When the resource last changed.
Link
Typed links to related resources.
Location
URL of a created resource or redirect target.
Origin
The web origin that initiated the request.
Permissions-Policy
Which browser features a page may use.
RateLimit
Remaining quota and reset time for the current rate-limit window.
Referrer-Policy
How much of the current URL browsers send as Referer.
Retry-After
How long to wait before retrying.
Server
Software that handled the request.
Set-Cookie
Asks the browser to store a cookie.
Strict-Transport-Security
Tells browsers to use HTTPS only for this host.
Traceparent
W3C trace context that links this request to a distributed trace.
Transfer-Encoding
How the body is framed for transfer.
User-Agent
Identifies the client software.
Vary
Request headers that change the response.
WWW-Authenticate
The authentication scheme the server expects.
X-Content-Type-Options
Stops browsers from guessing the content type.
X-Frame-Options
Whether the page may be shown in a frame.
X-Powered-By
Names the framework that generated the response.
X-Request-Id
A unique ID for this request.