HTTP status codes
Updated Free mock REST & WebSocket APIs
Every HTTP response starts with a three-digit status code telling the client what happened. Search the complete list below — each code has its own page with what it means, common causes, how to fix it and copy-paste server examples.
1xx Informational
Interim responses: the request was received and processing continues.
- 100ContinueThe server received the request headers and the client should go ahead and send the body.
- 101Switching ProtocolsThe server agrees to switch to the protocol the client asked for in the Upgrade header.
- 102ProcessingdeprecatedAn interim WebDAV response saying the server is still working on a long request.
- 103Early HintsAn interim response carrying Link headers so the browser can preload resources while the server prepares the real response.
2xx Success
The request was received, understood and accepted.
- 200OKThe request succeeded and the response contains the result.
- 201CreatedThe request succeeded and created a new resource, usually identified by the Location header.
- 202AcceptedThe request was accepted for processing, but the processing hasn't finished.
- 203Non-Authoritative InformationThe request succeeded but a transforming proxy modified the origin's response.
- 204No ContentThe request succeeded and there is intentionally no response body.
- 205Reset ContentThe request succeeded and the client should reset the document view (e.g. clear a form).
- 206Partial ContentThe server is returning only the byte range the client asked for in its Range header.
- 207Multi-StatusA WebDAV response whose XML body holds a separate status for each of several resources.
- 208Already ReportedInside a 207 body: this resource was already listed earlier, so it isn't repeated.
- 226IM UsedThe server applied an instance manipulation (such as a delta encoding) to the response.
3xx Redirection
Further action (usually following a Location header) is needed to complete the request.
- 300Multiple ChoicesThe resource has several representations and the client (or user) should choose one.
- 301Moved PermanentlyThe resource has a new permanent URL, given in the Location header.
- 302FoundThe resource is temporarily at a different URL, given in the Location header.
- 303See OtherThe response to this request is at another URL, which the client should fetch with GET.
- 304Not ModifiedThe cached copy the client already has is still valid, so no body is sent.
- 305Use ProxydeprecatedDeprecated: the resource had to be accessed through the proxy in the Location header.
- 306(Unused)deprecatedReserved: it was used in a draft specification and is no longer used.
- 307Temporary RedirectThe resource is temporarily at another URL and the client must repeat the request with the same method and body.
- 308Permanent RedirectThe resource has a new permanent URL and the client must repeat the request with the same method and body.
4xx Client Error
The request contains an error or can't be fulfilled — fix the request before retrying.
- 400Bad RequestThe server can't process the request because it's malformed or invalid.
- 401UnauthorizedThe request lacks valid authentication credentials; it must include a WWW-Authenticate challenge.
- 402Payment RequiredReserved for future use; some APIs use it when a payment or paid plan is required.
- 403ForbiddenThe server understood the request but refuses to authorize it.
- 404Not FoundThe server can't find anything at the requested URL.
- 405Method Not AllowedThe URL exists but doesn't support the HTTP method used; the Allow header lists the ones it does.
- 406Not AcceptableThe server can't produce a response matching the client's Accept headers.
- 407Proxy Authentication RequiredLike 401, but the client must first authenticate with the proxy in between.
- 408Request TimeoutThe server timed out waiting for the client to finish sending the request.
- 409ConflictThe request conflicts with the current state of the resource.
- 410GoneThe resource used to exist but was removed on purpose and won't come back.
- 411Length RequiredThe server refuses a request with a body but no Content-Length header.
- 412Precondition FailedA condition in the request headers (If-Match, If-Unmodified-Since…) evaluated to false.
- 413Content Too LargeThe request body is larger than the server is willing to accept.
- 414URI Too LongThe URL is longer than the server is willing to interpret.
- 415Unsupported Media TypeThe server refuses the request because the body's format (Content-Type) isn't supported.
- 416Range Not SatisfiableThe byte range requested in the Range header is outside the size of the resource.
- 417Expectation FailedThe server can't meet the requirement in the request's Expect header.
- 418I'm a teapotA joke code from the 1998 Hyper Text Coffee Pot Control Protocol: the server refuses to brew coffee because it is a teapot.
- 419Page ExpiredLaravelLaravel's response when the CSRF token is missing or expired, usually after a session times out.
- 421Misdirected RequestThe request reached a server that isn't configured to answer for that host and scheme.
- 422Unprocessable ContentThe request is well-formed, but its contents fail validation.
- 423LockedThe resource is locked and can't be modified right now.
- 424Failed DependencyThe action failed because another action it depended on failed.
- 425Too EarlyThe server won't process a request sent in TLS 1.3 early data (0-RTT) because it might be replayed.
- 426Upgrade RequiredThe server refuses to handle the request over the current protocol; the Upgrade header names the required one.
- 428Precondition RequiredThe server requires the request to be conditional (If-Match etc.) to prevent lost updates.
- 429Too Many RequestsThe client sent too many requests in a given time (rate limiting).
- 431Request Header Fields Too LargeThe server refuses the request because a header — or all headers together — is too large.
- 444No Responsenginxnginx closes the connection without sending any response.
- 451Unavailable For Legal ReasonsThe resource is blocked for legal reasons, such as a court order or government censorship.
- 494Request Header Too Largenginxnginx's internal code for a request header or cookie that exceeds its buffer size.
- 495SSL Certificate Errornginxnginx: the client presented an invalid TLS client certificate.
- 496SSL Certificate Requirednginxnginx: a client certificate was required but none was provided.
- 497HTTP Request Sent to HTTPS Portnginxnginx: a plain-HTTP request arrived on a port that expects HTTPS.
- 499Client Closed Requestnginxnginx logs 499 when the client closed the connection before the server finished responding.
5xx Server Error
The server failed to fulfill a valid request — usually temporary, or a server-side bug.
- 500Internal Server ErrorThe server hit an unexpected condition that prevented it from fulfilling the request.
- 501Not ImplementedThe server doesn't support the functionality (usually the HTTP method) needed to fulfill the request.
- 502Bad GatewayA gateway or proxy got an invalid response from the upstream server.
- 503Service UnavailableThe server is temporarily unable to handle the request (overload or maintenance).
- 504Gateway TimeoutA gateway or proxy didn't get a response from the upstream server in time.
- 505HTTP Version Not SupportedThe server doesn't support the HTTP protocol version used in the request.
- 506Variant Also NegotiatesServer misconfiguration: the chosen content-negotiation variant is itself configured to negotiate, creating a loop.
- 507Insufficient StorageThe server can't store what's needed to complete the request (disk or quota full).
- 508Loop DetectedThe server stopped processing because it found an infinite loop.
- 509Bandwidth Limit ExceededApache / cPanelA shared hosting account has used up its bandwidth allowance.
- 510Not ExtendeddeprecatedThe request needs an HTTP extension the client didn't declare (obsolete HTTP Extension Framework).
- 511Network Authentication RequiredThe client must authenticate to gain network access (captive portal).
- 520Web Server Returned an Unknown ErrorCloudflareCloudflare got an empty, unknown or unexpected response from the origin server.
- 521Web Server Is DownCloudflareCloudflare couldn't connect to the origin because it refused the connection.
- 522Connection Timed OutCloudflareCloudflare's TCP connection to the origin timed out before it was established.
- 523Origin Is UnreachableCloudflareCloudflare couldn't reach the origin at all — usually a DNS or routing problem.
- 524A Timeout OccurredCloudflareCloudflare connected to the origin, but it didn't send an HTTP response within 100 seconds.
- 525SSL Handshake FailedCloudflareCloudflare couldn't complete the TLS handshake with the origin server.
- 526Invalid SSL CertificateCloudflareIn Full (strict) mode, Cloudflare couldn't validate the origin's TLS certificate.
- 530Origin DNS ErrorCloudflareCloudflare returns 530 together with a 1xxx error, most often 1016 (origin DNS error).
The five classes of status codes
| Range | Class | Meaning |
|---|---|---|
1xx | Informational | Interim responses: the request was received and processing continues. |
2xx | Success | The request was received, understood and accepted. |
3xx | Redirection | Further action (usually following a Location header) is needed to complete the request. |
4xx | Client Error | The request contains an error or can't be fulfilled — fix the request before retrying. |
5xx | Server Error | The server failed to fulfill a valid request — usually temporary, or a server-side bug. |
Clients that don't recognise a code must treat it like the x00 code of its class — an unknown 499 is handled like 400 — which is why vendors can add their own codes.
Cheat sheet: the codes you'll actually see
| Code | Name | In one line |
|---|---|---|
| 200 | OK | The request succeeded and the response contains the result. |
| 201 | Created | The request succeeded and created a new resource, usually identified by the Location header. |
| 204 | No Content | The request succeeded and there is intentionally no response body. |
| 301 | Moved Permanently | The resource has a new permanent URL, given in the Location header. |
| 302 | Found | The resource is temporarily at a different URL, given in the Location header. |
| 304 | Not Modified | The cached copy the client already has is still valid, so no body is sent. |
| 400 | Bad Request | The server can't process the request because it's malformed or invalid. |
| 401 | Unauthorized | The request lacks valid authentication credentials; it must include a WWW-Authenticate challenge. |
| 403 | Forbidden | The server understood the request but refuses to authorize it. |
| 404 | Not Found | The server can't find anything at the requested URL. |
| 405 | Method Not Allowed | The URL exists but doesn't support the HTTP method used; the Allow header lists the ones it does. |
| 409 | Conflict | The request conflicts with the current state of the resource. |
| 422 | Unprocessable Content | The request is well-formed, but its contents fail validation. |
| 429 | Too Many Requests | The client sent too many requests in a given time (rate limiting). |
| 500 | Internal Server Error | The server hit an unexpected condition that prevented it from fulfilling the request. |
| 502 | Bad Gateway | A gateway or proxy got an invalid response from the upstream server. |
| 503 | Service Unavailable | The server is temporarily unable to handle the request (overload or maintenance). |
| 504 | Gateway Timeout | A gateway or proxy didn't get a response from the upstream server in time. |
How to check the status code of a URL
- Browser: open DevTools (F12) → Network tab, reload, and read the Status column. Click a request to see all response headers.
- Terminal:
curl -I https://example.comprints the status line and headers; add-Lto follow redirects and see every hop. - JavaScript:
const res = await fetch(url); console.log(res.status, res.ok);—res.okis true for 200–299. - Test your error handling: point your app at
https://mockfox.dev/api/status/503(any code 200–599) to see how it behaves.
Choosing the right code for your API
- Created something? 201 with a
Locationheader. Nothing to return? 204. - Malformed request → 400; valid JSON that fails validation → 422; duplicate or version conflict → 409.
- Not logged in → 401; logged in but not allowed → 403.
- Rate limited → 429 with
Retry-After; down for maintenance → 503.
Related tools
Frequently asked questions
How many HTTP status codes are there?
The IANA registry lists around 60 assigned codes from 100 to 511. This list also covers common unofficial codes used by nginx (444, 499), Cloudflare (520–530) and Laravel (419).
What are the most common HTTP status codes?
200 OK, 301/302 redirects, 304 Not Modified, 404 Not Found and 500 Internal Server Error make up the vast majority of web traffic. APIs also frequently return 201, 204, 400, 401, 403, 422 and 429.
How do I check a page's status code?
Open the browser DevTools Network tab and look at the Status column, or run curl -I https://example.com in a terminal to print just the status line and headers.
What's the difference between 4xx and 5xx errors?
4xx codes mean the server thinks the request is at fault (bad URL, missing auth, invalid data). 5xx codes mean the server failed to handle a request that may be valid.
Can I get a test URL that returns a specific status code?
Yes: https://mockfox.dev/api/status/{code} returns that status (200–599) for any method, with CORS enabled. Add ?delay=ms for latency and ?location=/path for redirects.