1xx Informational Response
This class of status codes indicates that the request was received and understood, and that processing is ongoing. It is a provisional response and alerts the client to await a final response. The message includes only the status line and optional headers, ending with an empty line. HTTP/1.0 does not support 1xx status codes, so servers should not send them to HTTP/1.0 clients except for experimental purposes.
Below is a list of all official 1xx Status Codes used in applications like API and Webhooks:
100 Continue:
Indicates that the server received the request headers and the client can send the body if needed. If the server responds with an error, the body should not be sent. A 417 Expectation Failed means the request should be retried without the Expect header.
101 Switching Protocols:
Shows that the server agrees to switch protocols as requested by the client.
102 Processing (WebDAV):
Used in WebDAV to signal that the server is still processing a complex request and no response is yet available. This status code is now deprecated.
103 Early Hints:
Allows the server to send some response headers before the final HTTP response message is sent.
2xx Success
This class of status codes indicates that the client’s request was successfully received, understood, and accepted.
Below is a list of all official 2xx Status Codes used in applications like API and Webhooks:
200 OK:
Indicates a successful HTTP request. The response depends on the method used: GET returns the requested resource; POST returns the result of the action.
201 Created:
The request was successful, resulting in the creation of a new resource.
202 Accepted:
The request has been accepted for processing but not yet completed. The request might be acted upon or disallowed later.
203 Non-Authoritative Information:
The server, acting as a proxy, modified the response from the origin server and is returning the modified version.
204 No Content:
The server successfully processed the request but is not returning any content.
205 Reset Content:
The server successfully processed the request and asks the client to reset the document view, without returning any content.
206 Partial Content:
The server is delivering only part of the resource due to a range header sent by the client. Useful for resuming interrupted downloads or splitting downloads.
207 Multi-Status (WebDAV):
The response body contains an XML message with multiple response codes for different sub-requests.
208 Already Reported (WebDAV):
The members of a DAV binding were already listed in a previous part of the response and are not included again.
226 IM Used:
The server has fulfilled the request and the response represents the result of one or more instance-manipulations applied to the resource.
3xx Redirection
This class of status codes indicates that the client must perform additional actions to complete the request. Many of these codes are used for URL redirection. User agents may automatically handle redirection for GET or HEAD methods without user interaction but should prevent cyclical redirects.
Below is a list of all official 3xx Status Codes used in applications like API and Webhooks:
300 Multiple Choices:
Indicates multiple options for the resource, and the client may choose from them, such as different file formats or URL options.
301 Moved Permanently:
The requested resource has been permanently moved to a new URI. Future requests should use this new URI.
302 Found:
Tells the client to redirect to another URL. Historically, it changed the request method to GET, but now HTTP/1.1 uses 303 and 307 to clarify behavior.
303 See Other:
The response is available at another URI using the GET method. For POST requests, the client should perform a GET request to the new URI.
304 Not Modified:
The resource has not been modified since the last request, so there’s no need to resend it.
305 Use Proxy:
The resource is only available through a proxy, and the address is provided. Many clients do not support this code for security reasons.
306 Switch Proxy:
No longer used; originally indicated that subsequent requests should use a specified proxy.
307 Temporary Redirect:
The request should be repeated with a different URI, but the request method must remain unchanged (e.g., POST should remain POST).
308 Permanent Redirect:
Similar to 301 but does not allow the HTTP method to change. Future requests should use the new URI without changing the method.
4xx Client Error Status Codes
This class of status codes is used when an error is likely caused by the client. Except for HEAD requests, the server should provide an explanation of the error and indicate if the issue is temporary or permanent. These codes apply to all request methods, and user agents should display any included explanation to the user.
Below is a list of all official 4xx Status Codes used in applications like API and Webhooks:
400 Bad Request:
Server cannot process request due to client error (e.g., malformed syntax, size too large).
401 Unauthorized:
Authentication required and has failed or not yet provided.
402 Payment Required:
Reserved for future use (e.g., exceeded request limit, insufficient funds, failed payment).
403 Forbidden:
Valid request but server refuses action (e.g., permissions issue, prohibited action).
404 Not Found:
Resource not found but may be available in the future.
405 Method Not Allowed:
Request method not supported for the requested resource.
406 Not Acceptable:
Resource generates only non-acceptable content according to Accept headers.
407 Proxy Authentication Required:
Client must authenticate with proxy.
408 Request Timeout:
Server timed out waiting for the request.
409 Conflict:
Request conflict with current state of the resource.
410 Gone:
Resource permanently removed and should not be requested again.
411 Length Required:
Content length required but not specified.
412 Precondition Failed:
Server does not meet request preconditions.
413 Payload Too Large:
Request larger than server is willing or able to process.
414 URI Too Long:
URI too long for server to process; often too much data in GET request.
415 Unsupported Media Type:
Media type not supported by server or resource.
416 Range Not Satisfiable:
Client requested part of the file that lies beyond the end of the file.
417 Expectation Failed:
Server cannot meet the requirements of the Expect request-header field.
418 I'm a teapot (RFC 2324, RFC 7168):
Defined as an April Fools' joke; returned by teapots requested to brew coffee.
421 Misdirected Request:
Request directed at a server unable to produce a response.
422 Unprocessable Content:
Request well-formed but could not be processed.
423 Locked (WebDAV; RFC 4918):
Resource is locked.
424 Failed Dependency (WebDAV; RFC 4918):
Request failed due to dependency on another failed request.
425 Too Early (RFC 8470):
Server unwilling to risk processing a request that might be replayed.
426 Upgrade Required:
Client should switch to a different protocol.
428 Precondition Required (RFC 6585):
Origin server requires request to be conditional to prevent conflict.
429 Too Many Requests (RFC 6585):
User has sent too many requests in a given amount of time.
431 Request Header Fields Too Large:
Request header fields too large for server to process.
451 Unavailable For Legal Reasons (RFC 7725):
Legal demand to deny access to a resource.
5xx Server Errors
This class of status codes indicates that the server failed to fulfill the request. These codes signify that the server encountered an error or was otherwise incapable of performing the request. Except for HEAD requests, the server should provide an explanation of the error and whether it is temporary or permanent. User agents should display this information to the user.
Below is a list of all official 5xx Status Codes used in applications like API and Webhooks:
500 Internal Server Error:
A generic error indicating an unexpected condition was encountered by the server.
501 Not Implemented:
The server does not recognize the request method or lacks the ability to fulfill the request.
502 Bad Gateway:
The server received an invalid response from an upstream server while acting as a gateway or proxy.
503 Service Unavailable:
The server cannot handle the request due to being overloaded or down for maintenance. This is usually temporary.
504 Gateway Timeout:
The server did not receive a timely response from an upstream server while acting as a gateway or proxy.
505 HTTP Version Not Supported:
The server does not support the HTTP version used in the request.
506 Variant Also Negotiates:
Transparent content negotiation resulted in a circular reference.
507 Insufficient Storage:
The server cannot store the representation needed to complete the request.
508 Loop Detected:
The server detected an infinite loop while processing the request, replacing 208 Already Reported.
510 Not Extended:
Further extensions to the request are required for the server to fulfill it.
511 Network Authentication Required:
The client needs to authenticate to gain network access, often used by intercepting proxies like captive portals.
Unofficial Status Codes
Below is a list of unofficial Status Codes from several sources used in applications like API and Webhooks.
218 This is fine:
Used by Apache servers to indicate a catch-all error condition, allowing message bodies to pass through when ProxyErrorOverride is enabled.
419 Page Expired:
Used by Laravel Framework when a CSRF token is missing or expired.
430 Request Header Fields Too Large:
Deprecated response used by Shopify when request headers are too large.
430 Shopify Security Rejection:
Used by Shopify to indicate a malicious request.
450 Blocked by Windows Parental Controls:
Indicates access is blocked due to Windows Parental Controls.
498 Invalid Token:
Returned by ArcGIS for Server when a token is expired or invalid.
499 Token Required:
Returned by ArcGIS for Server when a required token is missing.
509 Bandwidth Limit Exceeded:
Indicates the server has exceeded its bandwidth limit.
529 Site is overloaded:
Used by Qualys SSLLabs to indicate that the site cannot process the request.
530 Site is frozen:
Used by Pantheon Systems to indicate a site has been frozen due to inactivity.
530 Origin DNS Error:
Indicates Cloudflare can't resolve the requested DNS record.
540 Temporarily Disabled:
Used by Shopify to signal a temporarily disabled endpoint.
598 Network read timeout error:
Informal convention used by some HTTP proxies to signal a network read timeout behind the proxy.
599 Network Connect Timeout Error:
Used by some HTTP proxies to indicate a network connect timeout behind the proxy.
783 Unexpected Token:
Used by Shopify to indicate a JSON syntax error in the request.
Used by Microsoft Internet Information Services (IIS):
440 Login Time-out:
Indicates the client's session has expired and they must log in again.
449 Retry With:
The server cannot fulfill the request because required information is missing; the client should retry with the required information.
451 Redirect:
Used in Exchange ActiveSync to indicate a more efficient server is available or that the server cannot access the user's mailbox.
Used by nginx:
444 No Response:
Instructs the server to return no information to the client and close the connection immediately.
494 Request header too large:
Indicates the client sent too large a request or header line.
495 SSL Certificate Error:
Used when the client has provided an invalid SSL certificate.
496 SSL Certificate Required:
Indicates a client certificate is required but not provided.
497 HTTP Request Sent to HTTPS Port:
Used when an HTTP request is made to an HTTPS port.
499 Client Closed Request:
Used when the client closed the request before the server could send a response.
Used by Cloudflare:
520 Web Server Returned an Unknown Error:
Indicates the origin server returned an empty, unknown, or unexpected response.
521 Web Server Is Down:
The origin server refused connections from Cloudflare.
522 Connection Timed Out:
Cloudflare timed out contacting the origin server.
523 Origin Is Unreachable:
Cloudflare could not reach the origin server due to incorrect or missing DNS records.
524 A Timeout Occurred:
Cloudflare completed a TCP connection to the origin server but did not receive a timely HTTP response.
525 SSL Handshake Failed:
Cloudflare could not negotiate an SSL/TLS handshake with the origin server.
526 Invalid SSL Certificate:
Cloudflare could not validate the SSL certificate on the origin server.
Used by AWS Elastic Load Balancing:
0:
Returned with an HTTP/2 GOAWAY frame if header length exceeds 8K bytes or more than 10K requests are served through one connection.
460:
Indicates the client closed the connection before the Elastic Load Balancer’s idle timeout period elapsed.
463:
The load balancer received an X-Forwarded-For header with more than 30 IP addresses.
464:
Incompatible protocol versions between the client and origin server.
561:
Authentication error from a server registered with a load balancer; returned when the IdP errors during user authentication.