HTTP Status Codes

Features

• Every registered status code across all five classes
• Instant filtering by code, name or description
• Guidance on when each code is appropriate
• Class filters for 1xx through 5xx
• Works offline once the page is cached

How to use it

1. Type a code or a word into the search box.
2. Or filter by class using the buttons.
3. Read the description and the usage guidance.
4. Copy the filtered list if you need it elsewhere.

Status codes people commonly get wrong

The 401 and 403 distinction is the most frequently muddled. 401 Unauthorized actually means unauthenticated, the request lacks valid credentials, and retrying with credentials might work. 403 Forbidden means the server knows who you are and you still may not have it; retrying with the same credentials will not help. A 401 response is required to include a WWW-Authenticate header telling the client how to authenticate.

Redirects have a subtlety that breaks form submissions. 301 and 302 historically allowed clients to change a POST into a GET when following the redirect, and most browsers do exactly that. 307 and 308 were introduced to guarantee the method and body are preserved. If you are redirecting anything other than a GET, use 307 or 308.

Two more worth knowing. 422 Unprocessable Content is the right code when a request is syntactically valid but semantically wrong, well-formed JSON that fails validation, where many APIs incorrectly return 400. And 429 Too Many Requests should always be accompanied by a Retry-After header; without it, clients have no way to back off sensibly and will usually just hammer you again.