What HTTP status codes mean, and which one to send
The 25 codes you actually meet in production, each with the things a reference table usually leaves out: whether a client may retry it, whether caches will store it by default, whether it is allowed to carry a body, and — for redirects — whether the request method survives and whether search engines move the URL.
Debugging something? Paste the log line, the curl output, or the JSON error body into Paste a log line or response above the list. Any status codes in it are pulled out and floated to the top, so you do not have to spot the number yourself.
2xx · Success
4The request was received, understood, and accepted. The differences between them are about what the response carries and what the client should do next.
3xx · Redirection
5Further action is needed to complete the request — almost always following a Location header. Which code you pick decides whether the method survives and whether search engines move the URL.
4xx · Client error
12The request itself was faulty: bad syntax, missing credentials, a resource that is not there. Repeating it unchanged will fail the same way.
5xx · Server error
4The request was valid but the server could not fulfil it. These are the ones worth retrying, and the ones that should page someone.
OK
The request has succeeded. The information returned via the response depends on the method used in the request.
Created
The request has been fulfilled and has resulted in one or more new resources being created.
Accepted
The request has been accepted for processing, but the processing has not been completed. The request might or might not be eventually acted upon.
No Content
The server has successfully fulfilled the request and that there is no additional content to send in the response payload body.
Moved Permanently
This and all future requests should be directed to the given URI.
Found
The requested resource resides temporarily under a different URI. Previously known as 'Moved Temporarily'.
Not Modified
Indicates that the resource has not been modified since the version specified by the request headers If-Modified-Since or If-None-Match.
Temporary Redirect
Similar to 302, but explicitly requires the client to retain the same HTTP method (e.g. POST remains POST) during the redirection.
Permanent Redirect
Similar to 301, but explicitly keeps the same HTTP method for the redirection.
Bad Request
The server cannot process the request because the client sent invalid syntax, malformed JSON, missing fields, or headers the endpoint cannot accept.
Unauthorized
Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided.
Forbidden
The request was valid, but the server is refusing action. The user might not have the necessary permissions for a resource.
Not Found
The requested resource could not be found but may be available in the future.
Method Not Allowed
A request method is not supported for the requested resource; for example, a GET request on a form that requires data to be presented via POST.
Request Timeout
The server timed out waiting for the request. The client did not produce a request within the time that the server was prepared to wait.
Conflict
Indicates that the request could not be processed because of conflict in the current state of the resource, such as an edit conflict.
Gone
Indicates that the resource requested is no longer available and will not be available again. This should be used when a resource has been intentionally removed.
Payload Too Large
The request is larger than the server is willing or able to process (e.g., uploading a massive image).
I'm a teapot
The server refuses the attempt to brew coffee with a teapot. An Easter egg code defined by an April Fools' joke in 1998 (RFC 2324).
Unprocessable Entity
The request was well-formed but was unable to be followed due to semantic errors. Very common in robust REST APIs for payload validation errors.
Too Many Requests
The user has sent too many requests in a given amount of time. Intended for use with rate-limiting schemes.
Internal Server Error
A generic error message, given when an unexpected condition was encountered and no more specific message is suitable.
Bad Gateway
The server was acting as a gateway or proxy and received an invalid response from the upstream server.
Service Unavailable
The server is currently unavailable (because it is overloaded or down for maintenance). Generally, this is a temporary state.
Gateway Timeout
The server was acting as a gateway or proxy and did not receive a timely response from the upstream server.
Choosing between the redirects
The four redirect codes differ on two axes, and picking the wrong one quietly breaks things. 301 and 308 are permanent, so search engines move the URL and carry its ranking signals over; 302 and 307 are temporary and leave the original indexed. Separately, 307 and 308 guarantee the method and body survive, while user agents have long rewritten a POST to a GET when following a 301 or 302 — which silently drops the payload of a form submission.
So: a permanent move of a page is a 301, a permanent move of an API endpoint that receives POSTs is a 308, a temporary diversion of a page is a 302, and a temporary diversion that must keep its body is a 307.