What Are HTTP Status Codes? A Complete Guide

HTTP status codes are three-digit numbers a server returns in its response to tell the client the outcome of a request, grouped into five classes by their first digit: 1xx informational, 2xx success, 3xx redirection, 4xx client error, and 5xx server error. Every HTTP response carries one, and choosing the correct code is how a well-behaved API or website communicates success, redirection, client mistakes, and server failures in a way that browsers, caches, crawlers, and client libraries all understand automatically. Using the wrong code causes subtle bugs, broken caching, and confused clients.

Key takeaways

• The first digit classifies the response: 1xx, 2xx, 3xx, 4xx, 5xx.
• 200 OK is generic success; prefer 201 Created and 204 No Content when they fit.
• 301 is a permanent redirect and 302/307 are temporary ones.
• 401 means not authenticated; 403 means authenticated but not permitted.
• 4xx blames the request; 5xx blames the server, and only some codes are safe to retry.
• Returning the semantically correct code lets caches, crawlers, and clients behave properly without custom logic.

What do the five status code classes mean?

The leading digit is the fastest way to understand any response.

What are the common 2xx success codes?

Success is not one-size-fits-all, and picking the precise code helps clients react correctly.

• 200 OK: the standard success response, typically with a body.
• 201 Created: a new resource was created; it is good practice to indicate the new resource’s location.
• 202 Accepted: the request was accepted for asynchronous processing that has not completed yet.
• 204 No Content: success with no response body, ideal for deletes and some updates.

A common mistake is returning 200 for everything. If a POST creates a resource, 201 communicates that fact; if there is nothing to return, 204 is clearer than an empty 200.

How do redirection (3xx) codes differ?

Redirects tell the client the resource lives elsewhere or has not changed, and the distinctions matter for SEO and correctness.

The key subtlety is method preservation: historically some clients changed a POST to a GET when following 301 and 302, whereas 307 and 308 were defined to keep the original method. 304 is special because it participates in caching rather than moving a resource.

When should I use 401 versus 403?

These two client errors are constantly confused. The distinction is about authentication versus authorization.

• 401 Unauthorized means the request lacks valid authentication credentials. The client should authenticate and try again. Despite the name, it is really about authentication.
• 403 Forbidden means the server understood the request and the client is authenticated, but the client is not permitted to access this resource. Re-authenticating will not help.

As a rule: if logging in could fix it, use 401; if the user is already known and still not allowed, use 403.

What are the most important 4xx client errors?

The 4xx class signals that the request itself is the problem, so retrying it unchanged will usually fail again.

• 400 Bad Request: the request is malformed or fails validation.
• 404 Not Found: the resource does not exist at that URL.
• 405 Method Not Allowed: the URL exists but the HTTP method is not supported for it.
• 409 Conflict: the request conflicts with the current state, such as a duplicate or a versioning clash.
• 422 Unprocessable Content: the syntax is valid but the content fails semantic validation.
• 429 Too Many Requests: the client is rate limited and should slow down.

The one 4xx code you generally should retry is 429, ideally after waiting; the server often indicates how long to wait.

What do the 5xx server errors indicate?

A 5xx code means the server, not the request, is at fault. The request may well be valid, so retrying can succeed once the server recovers.

• 500 Internal Server Error: a generic, unexpected server failure.
• 502 Bad Gateway: a proxy or gateway received an invalid response from an upstream server.
• 503 Service Unavailable: the server is temporarily overloaded or down for maintenance.
• 504 Gateway Timeout: a gateway did not receive a timely response from upstream.

Because these are often transient, clients should retry idempotent requests with exponential backoff rather than hammering the server. Avoid leaking internal error details in 500 bodies, since that can expose sensitive information.

How do I choose the right status code?

Work through a short decision path for each response:

1. Did it succeed? Choose a 2xx, preferring 201 for creation and 204 for empty bodies.
2. Does the resource live elsewhere or is it cached? Choose the appropriate 3xx, minding permanence and method preservation.
3. Is the request itself wrong? Choose a 4xx, distinguishing authentication (401), permission (403), absence (404), and validation (400/422).
4. Did the server fail? Choose a 5xx and log the internal cause without exposing it.

Consistency matters: a client should be able to trust that your codes mean exactly what the standard says, so that generic HTTP tooling handles retries, caching, and error reporting correctly.

What common status code mistakes should I avoid?

1. Returning 200 with an error message in the body. Clients and monitoring treat it as success.
2. Using 200 for a failed operation. Errors deserve the matching 4xx or 5xx code.
3. Confusing 401 and 403. Authentication versus authorization, respectively.
4. Using 302 where 301 is meant. Permanent moves need 301 so caches and crawlers update.
5. Retrying non-retryable 4xx codes. Only 429 among common client errors is worth retrying.

Frequently asked questions

What are the five classes of HTTP status codes?

1xx informational, 2xx success, 3xx redirection, 4xx client errors, and 5xx server errors. The first digit tells you the category of the response.

What is the difference between 301 and 302?

301 signals a permanent redirect, so clients and search engines should update the URL, while 302 is a temporary redirect that leaves the original URL as the canonical one.

When should I return 401 versus 403?

Return 401 Unauthorized when authentication is missing or invalid, and 403 Forbidden when the user is authenticated but not allowed to access the resource.

What does 204 No Content mean?

The request succeeded but there is no body to return. It is common for actions like a successful delete or an update that needs no response payload.

Is 200 always the right success code?

Not always. Use 201 Created when a request creates a resource and 204 No Content when there is no body, so the code accurately describes what happened.

What is the difference between 502 and 503?

502 Bad Gateway means a server acting as a proxy got an invalid response from upstream, while 503 Service Unavailable means the server is temporarily unable to handle the request.

Should a client retry on a 4xx code?

Generally no, because 4xx means the request itself is faulty and will fail again unchanged. 429 is an exception, where the client should retry after a delay.