Every HTTP status code with what it means and when to send it, searchable by number, phrase or description.
The request succeeded and the response body carries the result. The default answer for a successful GET, PUT or POST.
A new resource was created. The Location header should point at it, and the body normally contains the created record.
Success with no body to return. Common for DELETE, and for PUT or PATCH when the client already knows the resulting state.
The resource has moved permanently. Search engines transfer ranking signals to the new URL, so use this for real, lasting moves.
The resource is temporarily somewhere else. The original URL stays indexed, which suits maintenance pages and short-lived tests.
The cached copy is still current, so no body is sent. Triggered by If-None-Match or If-Modified-Since and it saves a lot of bandwidth.
A temporary redirect that keeps the original method and body, unlike 302, which many clients silently turn into a GET.
A permanent redirect that keeps the original method and body. The safe permanent choice for POST endpoints that have moved.
The server could not understand the request. Usually malformed JSON, a broken query string or an invalid header rather than a business rule failure.
Authentication is missing or was rejected. Despite the name, this is about identity, and authenticating correctly may well fix it.
The server understood who you are and is refusing anyway. Unlike 401, retrying with the same credentials will not help.
The resource does not exist at that URL. Also used deliberately to hide the existence of something the caller may not know about.
The URL exists but not for that HTTP method, for example a POST to a read-only endpoint. The response should list what is allowed.
The request conflicts with the current state, such as an edit based on a stale version or creating something that already exists.
The request body is larger than the server is willing to process. Commonly hit on file uploads behind a proxy with a low limit.
The body is in a format the endpoint does not accept, such as sending form data to an endpoint that only takes JSON.
The syntax was fine but the content failed validation, such as a missing required field. The usual choice for form and API validation errors.
Too many requests in too short a time. The Retry-After header should tell the client how long to wait before trying again.
Something failed inside the server while handling a valid request. The catch-all when no more specific code applies, and it means check the logs.
A proxy or load balancer got an invalid or empty response from the upstream service, usually because it crashed or is not listening.
The service is temporarily unable to handle the request, through overload or maintenance. Add Retry-After so clients back off sensibly.
A proxy waited for the upstream service and it never answered in time. Points at something slow or hung rather than something crashed.
Type a number such as 404, a phrase such as gateway, or a word from the meaning. You can also filter by class to see only redirects, client errors or server errors.
Each code has a plain explanation of what the server is saying and when you should send it, rather than only the one-word reason phrase from the specification.
The copy button gives you the code and its canonical reason phrase together, ready to drop into a response, a test assertion or a piece of documentation.
1xx is informational, 2xx means the request succeeded, 3xx asks the client to go somewhere else, 4xx says the client made a mistake, and 5xx says the server failed while handling an otherwise valid request.
401 means you have not authenticated, or your credentials were not accepted, so authenticating might help. 403 means the server knows who you are and is still refusing, so retrying with the same identity will not help.
301 is permanent and tells search engines to move ranking signals to the new URL, so use it for real moves. 302 is temporary and leaves the original URL indexed, which suits maintenance pages and A/B tests.
A proxy or load balancer reached your application and got an invalid or empty response. Usually the upstream process crashed, ran out of memory, or is not listening on the port the proxy expects.
502 means the upstream replied with something invalid. 504 means it did not reply in time at all. The first points at a crash or misconfiguration, the second at something slow or hung.
No. Use the status code to say what happened at the HTTP level and put the detail in the body. Returning 200 with an error object breaks caching, monitoring and every generic client that checks the status.
400 means the request itself was malformed, such as broken JSON. 422 means the syntax parsed fine but the content failed validation, such as a missing required field or an email that is not an email.
It comes from an April Fools specification about coffee pots and is reserved rather than usable. Do not send it in a real API, but it is here because people genuinely look it up.
Online JWT decoder, no login required. Paste a JSON Web Token to inspect its header, payload and expiration. Decoding happens entirely in your browser.
Open ToolFree online JSON formatter and validator. Format, minify and validate JSON with syntax highlighting and instant error detection.
Open ToolPercent encode and decode URLs and query strings, with a breakdown of every part of the address.
Open Tool