AZ Tools

HTTP Status Code Reference

Network

All 60+ standardized HTTP response codes from 100 Continue to 511 Network Authentication Required, with a one-line summary, RFC reference, recommended usage, and a 'pitfall' note for codes that are commonly misused (401 vs 403, 301 caching forever, 400 vs 422, etc). Filter by class (1xx informational, 2xx success, 3xx redirect, 4xx client, 5xx server) or full-text search across code, name, summary, and notes.

—

Matches: 61

  • 100Continue

    Server received headers; client should send the body.

    RFC: RFC 9110 §15.2.1

  • 101Switching Protocols

    Server agrees to switch protocols (e.g., HTTP/2, WebSocket).

    When: WebSocket upgrade handshakes.

    RFC: RFC 9110 §15.2.2

  • 102Processing

    WebDAV: request received but no response yet.

    RFC: RFC 2518

  • 103Early Hints

    Preload hints sent before the final response.

    When: Send Link: rel=preload for critical assets before the slow backend reply lands.

    RFC: RFC 8297

  • 200OK

    Standard success response with a body.

    RFC: RFC 9110 §15.3.1

  • 201Created

    Resource was created; include Location header pointing to it.

    When: POST that creates a new resource. Body is optional.

    RFC: RFC 9110 §15.3.2

  • 202Accepted

    Request accepted for async processing; no result yet.

    When: Long-running jobs — return a status URL for the client to poll.

    RFC: RFC 9110 §15.3.3

  • 203Non-Authoritative Information

    Response was transformed by a proxy.

    RFC: RFC 9110 §15.3.4

  • 204No Content

    Success but no body to send.

    When: DELETE success, PUT with no useful body, preflight OK.

    Pitfall: MUST NOT include a message body. Some libraries error if you do.

    RFC: RFC 9110 §15.3.5

  • 205Reset Content

    Success; client should reset the document view (clear form).

    RFC: RFC 9110 §15.3.6

  • 206Partial Content

    Range request was honored; partial body follows.

    When: Resumable downloads, video seek.

    RFC: RFC 9110 §15.3.7

  • 207Multi-Status

    WebDAV multi-resource batched results.

    RFC: RFC 4918

  • 208Already Reported

    WebDAV: bindings already enumerated earlier in the response.

    RFC: RFC 5842

  • 226IM Used

    Delta encoding response.

    RFC: RFC 3229

  • 300Multiple Choices

    Multiple resources match; client should pick one.

    RFC: RFC 9110 §15.4.1

  • 301Moved Permanently

    Resource has a new permanent URL. Caches forever.

    When: Domain migration, URL restructure.

    Pitfall: Browsers cache 301 aggressively — fixing a wrong one is painful. Test with 302 first.

    RFC: RFC 9110 §15.4.2

  • 302Found

    Temporary redirect (legacy semantics, method may change).

    Pitfall: Historically rewrote POST→GET. Use 303 or 307 for explicit method-preservation semantics.

    RFC: RFC 9110 §15.4.3

  • 303See Other

    Redirect that always becomes a GET.

    When: POST/Redirect/GET pattern after form submit.

    RFC: RFC 9110 §15.4.4

  • 304Not Modified

    Conditional request: cached copy is still fresh.

    When: Response to If-None-Match / If-Modified-Since.

    Pitfall: MUST NOT include a body.

    RFC: RFC 9110 §15.4.5

  • 307Temporary Redirect

    Temporary; method and body must be preserved.

    RFC: RFC 9110 §15.4.8

  • 308Permanent Redirect

    Permanent; method and body must be preserved.

    When: POSTs that must survive a permanent move. Prefer over 301 for API endpoints.

    RFC: RFC 9110 §15.4.9

  • 400Bad Request

    Generic malformed request the server cannot parse.

    Pitfall: Don't use 400 for valid syntax with bad semantics — use 422 instead.

    RFC: RFC 9110 §15.5.1

  • 401Unauthorized

    Authentication required or failed. Must include WWW-Authenticate.

    Pitfall: Misnamed historically — means "unauthenticated". Use 403 for "authenticated but not allowed".

    RFC: RFC 9110 §15.5.2

  • 402Payment Required

    Reserved for future use; some APIs use for billing failures.

    RFC: RFC 9110 §15.5.3

  • 403Forbidden

    Authenticated but the action is not allowed for this principal.

    When: Authorization failure, geo-block, or "you cannot do this regardless of auth".

    RFC: RFC 9110 §15.5.4

  • 404Not Found

    Resource does not exist (or you are hiding it).

    When: Often returned instead of 403 to avoid disclosing existence.

    RFC: RFC 9110 §15.5.5

  • 405Method Not Allowed

    Resource exists but does not support this verb. MUST include Allow header.

    RFC: RFC 9110 §15.5.6

  • 406Not Acceptable

    No representation matches the Accept headers.

    RFC: RFC 9110 §15.5.7

  • 407Proxy Authentication Required

    Like 401 but for proxies. Must include Proxy-Authenticate.

    RFC: RFC 9110 §15.5.8

  • 408Request Timeout

    Server gave up waiting for the request to finish.

    RFC: RFC 9110 §15.5.9

  • 409Conflict

    Request collides with current state (e.g., edit conflict, duplicate).

    When: Unique-key violations on creation, version mismatch on update.

    RFC: RFC 9110 §15.5.10

  • 410Gone

    Resource permanently removed with no forwarding address.

    When: Use over 404 when you want crawlers/clients to drop the URL permanently.

    RFC: RFC 9110 §15.5.11

  • 411Length Required

    Server requires Content-Length and the request omitted it.

    RFC: RFC 9110 §15.5.12

  • 412Precondition Failed

    If-Match / If-Unmodified-Since check failed.

    When: Optimistic concurrency control on updates.

    RFC: RFC 9110 §15.5.13

  • 413Content Too Large

    Body exceeds the server limit. Formerly "Payload Too Large".

    RFC: RFC 9110 §15.5.14

  • 414URI Too Long

    URL exceeds server limit (commonly ~8KB).

    RFC: RFC 9110 §15.5.15

  • 415Unsupported Media Type

    Content-Type is not supported by this endpoint.

    RFC: RFC 9110 §15.5.16

  • 416Range Not Satisfiable

    Range header asks for bytes outside the resource.

    RFC: RFC 9110 §15.5.17

  • 417Expectation Failed

    Server cannot meet the Expect: header requirements.

    RFC: RFC 9110 §15.5.18

  • 418I'm a teapot

    April-fools status (RFC 2324). Returned by some debugging or honeypot endpoints.

    RFC: RFC 2324

  • 421Misdirected Request

    Request was routed to a server that cannot produce a response (e.g., wrong SNI).

    RFC: RFC 9110 §15.5.20

  • 422Unprocessable Content

    Syntactically valid but semantically incorrect (e.g., validation failure).

    When: Form-level validation errors on a JSON API.

    RFC: RFC 9110 §15.5.21

  • 423Locked

    WebDAV: resource is locked.

    RFC: RFC 4918

  • 424Failed Dependency

    WebDAV: a previous request in the chain failed.

    RFC: RFC 4918

  • 425Too Early

    Server refuses replay-vulnerable early data (TLS 1.3 0-RTT).

    RFC: RFC 8470

  • 426Upgrade Required

    Client must upgrade to a different protocol. Include Upgrade header.

    RFC: RFC 9110 §15.5.22

  • 428Precondition Required

    Server requires the request to be conditional (If-Match etc).

    When: APIs that demand optimistic-concurrency tokens to prevent lost updates.

    RFC: RFC 6585

  • 429Too Many Requests

    Rate-limited. Include Retry-After header.

    RFC: RFC 6585

  • 431Request Header Fields Too Large

    Sum of headers exceeds the server limit.

    RFC: RFC 6585

  • 451Unavailable For Legal Reasons

    Blocked due to legal demand (Fahrenheit 451 reference).

    RFC: RFC 7725

  • 500Internal Server Error

    Unhandled exception or generic server crash.

    Pitfall: Never expose stack traces — log them server-side only.

    RFC: RFC 9110 §15.6.1

  • 501Not Implemented

    Server does not support the requested method at all.

    RFC: RFC 9110 §15.6.2

  • 502Bad Gateway

    Upstream returned an invalid response to the gateway.

    When: Load balancer cannot reach origin; origin returned junk.

    RFC: RFC 9110 §15.6.3

  • 503Service Unavailable

    Server temporarily down or overloaded. Should include Retry-After.

    RFC: RFC 9110 §15.6.4

  • 504Gateway Timeout

    Gateway gave up waiting for upstream.

    RFC: RFC 9110 §15.6.5

  • 505HTTP Version Not Supported

    Server does not support the HTTP version in the request.

    RFC: RFC 9110 §15.6.6

  • 506Variant Also Negotiates

    Transparent content negotiation is misconfigured.

    RFC: RFC 2295

  • 507Insufficient Storage

    WebDAV: server cannot store the representation.

    RFC: RFC 4918

  • 508Loop Detected

    WebDAV: infinite loop while processing.

    RFC: RFC 5842

  • 510Not Extended

    Further extensions required to fulfill the request.

    RFC: RFC 2774

  • 511Network Authentication Required

    Captive portal: log in to the network first.

    When: Public Wi-Fi splash pages.

    RFC: RFC 6585

How to use

  1. Type a code, name, or any word in the search bar (e.g. "redirect", "rate limit", "422").
  2. Optionally filter by class with the colored chips.
  3. Read summary, when-to-use, common pitfalls, and the RFC reference for each match.

Frequently asked questions

Why call out a 'pitfall' for some codes?
A handful of status codes are routinely misapplied. 401 means 'unauthenticated' but reads like 'unauthorized'; 301 caches in browsers effectively forever; 400 vs 422 is constantly fought over. These notes flag the specific traps that bite teams in code review or post-incident.
Are WebDAV codes included?
Yes — 102, 207, 208, 423, 424, 507, 508 are listed with their RFC. Even if you don't use WebDAV, libraries and proxies sometimes surface them, so it's worth knowing what they mean.
What about non-standard codes (like Cloudflare's 520-527)?
Vendor-specific codes (Cloudflare 520-527, AWS' 460/463, IIS' 440) are excluded — they're not in any RFC and meanings differ by vendor. Look those up in the specific vendor's docs.
Why is the 'when to use' field empty for some codes?
If the code is trivially named (200 OK, 500 Internal Server Error) or only ever appears in special contexts, the summary alone is enough. The when/pitfall fields only show when there's a real call-it-out story.

Related tools

URL Query Builder

Build URLs by combining a base address with editable key-value query parameters — each pair toggleable, properly percent-encoded.

Network00

IP Address Inspector

Type an IPv4 or IPv6 address and see its class, scope (private / public / loopback / link-local), decimal value, binary, reverse-DNS notation, and /32 CIDR.

Network00

Port Number Reference

Searchable cheat sheet for ~60 standard TCP / UDP port numbers — from 22 (SSH) and 80 (HTTP) to 6379 (Redis) and 27017 (MongoDB).

Network00

DNS Record Reference

Searchable cheat sheet for DNS record types — A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV, CAA, DNSSEC, SVCB / HTTPS — with examples.

Network00

Subnet Calculator (IPv4 / CIDR)

Parse an IPv4 CIDR into network address, broadcast, netmask, wildcard, host range, and class. Shows binary breakdown and private/public status.

Network00

User Agent Parser

Parse a User-Agent string into browser, engine, OS, device, and CPU. Detects 20+ bots including GPTBot, ClaudeBot, PerplexityBot.

Network00