Saltar al contenido
AZ Tools

Referencia de Códigos de Estado HTTP

Más de 60 códigos de respuesta HTTP estandarizados, de 100 Continue a 511 Network Authentication Required, con resumen en una línea, referencia RFC, uso recomendado y nota de 'trampa' para los códigos que se malusan típicamente (401 vs 403, el 301 cacheado para siempre, 400 vs 422, etc). Filtra por clase (1xx informativos, 2xx éxito, 3xx redirección, 4xx cliente, 5xx servidor) o busca por código, nombre, resumen y notas.

—

Coincidencias: 61

  • 100Continue

    Server received headers; client should send the body.

    RFC: RFC 9110 §15.2.1

  • 101Switching Protocols

    Server agrees to switch protocols (e.g., HTTP/2, WebSocket).

    Cuándo: WebSocket upgrade handshakes.

    RFC: RFC 9110 §15.2.2

  • 102Processing

    WebDAV: request received but no response yet.

    RFC: RFC 2518

  • 103Early Hints

    Preload hints sent before the final response.

    Cuándo: Send Link: rel=preload for critical assets before the slow backend reply lands.

    RFC: RFC 8297

  • 200OK

    Standard success response with a body.

    RFC: RFC 9110 §15.3.1

  • 201Created

    Resource was created; include Location header pointing to it.

    Cuándo: POST that creates a new resource. Body is optional.

    RFC: RFC 9110 §15.3.2

  • 202Accepted

    Request accepted for async processing; no result yet.

    Cuándo: Long-running jobs — return a status URL for the client to poll.

    RFC: RFC 9110 §15.3.3

  • 203Non-Authoritative Information

    Response was transformed by a proxy.

    RFC: RFC 9110 §15.3.4

  • 204No Content

    Success but no body to send.

    Cuándo: DELETE success, PUT with no useful body, preflight OK.

    Trampa: MUST NOT include a message body. Some libraries error if you do.

    RFC: RFC 9110 §15.3.5

  • 205Reset Content

    Success; client should reset the document view (clear form).

    RFC: RFC 9110 §15.3.6

  • 206Partial Content

    Range request was honored; partial body follows.

    Cuándo: Resumable downloads, video seek.

    RFC: RFC 9110 §15.3.7

  • 207Multi-Status

    WebDAV multi-resource batched results.

    RFC: RFC 4918

  • 208Already Reported

    WebDAV: bindings already enumerated earlier in the response.

    RFC: RFC 5842

  • 226IM Used

    Delta encoding response.

    RFC: RFC 3229

  • 300Multiple Choices

    Multiple resources match; client should pick one.

    RFC: RFC 9110 §15.4.1

  • 301Moved Permanently

    Resource has a new permanent URL. Caches forever.

    Cuándo: Domain migration, URL restructure.

    Trampa: Browsers cache 301 aggressively — fixing a wrong one is painful. Test with 302 first.

    RFC: RFC 9110 §15.4.2

  • 302Found

    Temporary redirect (legacy semantics, method may change).

    Trampa: Historically rewrote POST→GET. Use 303 or 307 for explicit method-preservation semantics.

    RFC: RFC 9110 §15.4.3

  • 303See Other

    Redirect that always becomes a GET.

    Cuándo: POST/Redirect/GET pattern after form submit.

    RFC: RFC 9110 §15.4.4

  • 304Not Modified

    Conditional request: cached copy is still fresh.

    Cuándo: Response to If-None-Match / If-Modified-Since.

    Trampa: MUST NOT include a body.

    RFC: RFC 9110 §15.4.5

  • 307Temporary Redirect

    Temporary; method and body must be preserved.

    RFC: RFC 9110 §15.4.8

  • 308Permanent Redirect

    Permanent; method and body must be preserved.

    Cuándo: POSTs that must survive a permanent move. Prefer over 301 for API endpoints.

    RFC: RFC 9110 §15.4.9

  • 400Bad Request

    Generic malformed request the server cannot parse.

    Trampa: Don't use 400 for valid syntax with bad semantics — use 422 instead.

    RFC: RFC 9110 §15.5.1

  • 401Unauthorized

    Authentication required or failed. Must include WWW-Authenticate.

    Trampa: Misnamed historically — means "unauthenticated". Use 403 for "authenticated but not allowed".

    RFC: RFC 9110 §15.5.2

  • 402Payment Required

    Reserved for future use; some APIs use for billing failures.

    RFC: RFC 9110 §15.5.3

  • 403Forbidden

    Authenticated but the action is not allowed for this principal.

    Cuándo: Authorization failure, geo-block, or "you cannot do this regardless of auth".

    RFC: RFC 9110 §15.5.4

  • 404Not Found

    Resource does not exist (or you are hiding it).

    Cuándo: Often returned instead of 403 to avoid disclosing existence.

    RFC: RFC 9110 §15.5.5

  • 405Method Not Allowed

    Resource exists but does not support this verb. MUST include Allow header.

    RFC: RFC 9110 §15.5.6

  • 406Not Acceptable

    No representation matches the Accept headers.

    RFC: RFC 9110 §15.5.7

  • 407Proxy Authentication Required

    Like 401 but for proxies. Must include Proxy-Authenticate.

    RFC: RFC 9110 §15.5.8

  • 408Request Timeout

    Server gave up waiting for the request to finish.

    RFC: RFC 9110 §15.5.9

  • 409Conflict

    Request collides with current state (e.g., edit conflict, duplicate).

    Cuándo: Unique-key violations on creation, version mismatch on update.

    RFC: RFC 9110 §15.5.10

  • 410Gone

    Resource permanently removed with no forwarding address.

    Cuándo: Use over 404 when you want crawlers/clients to drop the URL permanently.

    RFC: RFC 9110 §15.5.11

  • 411Length Required

    Server requires Content-Length and the request omitted it.

    RFC: RFC 9110 §15.5.12

  • 412Precondition Failed

    If-Match / If-Unmodified-Since check failed.

    Cuándo: Optimistic concurrency control on updates.

    RFC: RFC 9110 §15.5.13

  • 413Content Too Large

    Body exceeds the server limit. Formerly "Payload Too Large".

    RFC: RFC 9110 §15.5.14

  • 414URI Too Long

    URL exceeds server limit (commonly ~8KB).

    RFC: RFC 9110 §15.5.15

  • 415Unsupported Media Type

    Content-Type is not supported by this endpoint.

    RFC: RFC 9110 §15.5.16

  • 416Range Not Satisfiable

    Range header asks for bytes outside the resource.

    RFC: RFC 9110 §15.5.17

  • 417Expectation Failed

    Server cannot meet the Expect: header requirements.

    RFC: RFC 9110 §15.5.18

  • 418I'm a teapot

    April-fools status (RFC 2324). Returned by some debugging or honeypot endpoints.

    RFC: RFC 2324

  • 421Misdirected Request

    Request was routed to a server that cannot produce a response (e.g., wrong SNI).

    RFC: RFC 9110 §15.5.20

  • 422Unprocessable Content

    Syntactically valid but semantically incorrect (e.g., validation failure).

    Cuándo: Form-level validation errors on a JSON API.

    RFC: RFC 9110 §15.5.21

  • 423Locked

    WebDAV: resource is locked.

    RFC: RFC 4918

  • 424Failed Dependency

    WebDAV: a previous request in the chain failed.

    RFC: RFC 4918

  • 425Too Early

    Server refuses replay-vulnerable early data (TLS 1.3 0-RTT).

    RFC: RFC 8470

  • 426Upgrade Required

    Client must upgrade to a different protocol. Include Upgrade header.

    RFC: RFC 9110 §15.5.22

  • 428Precondition Required

    Server requires the request to be conditional (If-Match etc).

    Cuándo: APIs that demand optimistic-concurrency tokens to prevent lost updates.

    RFC: RFC 6585

  • 429Too Many Requests

    Rate-limited. Include Retry-After header.

    RFC: RFC 6585

  • 431Request Header Fields Too Large

    Sum of headers exceeds the server limit.

    RFC: RFC 6585

  • 451Unavailable For Legal Reasons

    Blocked due to legal demand (Fahrenheit 451 reference).

    RFC: RFC 7725

  • 500Internal Server Error

    Unhandled exception or generic server crash.

    Trampa: Never expose stack traces — log them server-side only.

    RFC: RFC 9110 §15.6.1

  • 501Not Implemented

    Server does not support the requested method at all.

    RFC: RFC 9110 §15.6.2

  • 502Bad Gateway

    Upstream returned an invalid response to the gateway.

    Cuándo: Load balancer cannot reach origin; origin returned junk.

    RFC: RFC 9110 §15.6.3

  • 503Service Unavailable

    Server temporarily down or overloaded. Should include Retry-After.

    RFC: RFC 9110 §15.6.4

  • 504Gateway Timeout

    Gateway gave up waiting for upstream.

    RFC: RFC 9110 §15.6.5

  • 505HTTP Version Not Supported

    Server does not support the HTTP version in the request.

    RFC: RFC 9110 §15.6.6

  • 506Variant Also Negotiates

    Transparent content negotiation is misconfigured.

    RFC: RFC 2295

  • 507Insufficient Storage

    WebDAV: server cannot store the representation.

    RFC: RFC 4918

  • 508Loop Detected

    WebDAV: infinite loop while processing.

    RFC: RFC 5842

  • 510Not Extended

    Further extensions required to fulfill the request.

    RFC: RFC 2774

  • 511Network Authentication Required

    Captive portal: log in to the network first.

    Cuándo: Public Wi-Fi splash pages.

    RFC: RFC 6585

Cómo usar

  1. Escribe un código, nombre o cualquier palabra en la barra de búsqueda (ej. "redirect", "rate limit", "422").
  2. Opcionalmente filtra por clase con los chips de color.
  3. Lee resumen, cuándo usar, trampas y la referencia RFC de cada coincidencia.

Preguntas frecuentes

¿Por qué destacar una 'trampa' en algunos códigos?
Hay códigos que se malusan rutinariamente. 401 significa 'no autenticado' pero se lee como 'no autorizado'; el 301 queda cacheado en navegadores prácticamente para siempre; 400 vs 422 se discute sin fin. Esas notas marcan las trampas que pillan a los equipos en code review o postmortem.
¿Incluye códigos WebDAV?
Sí — 102, 207, 208, 423, 424, 507, 508 con su RFC. Aunque no uses WebDAV, librerías y proxies a veces los exponen, conviene saber qué significan.
¿Y los códigos no estándar (Cloudflare 520-527 etc)?
Códigos específicos de fabricante (Cloudflare 520-527, AWS 460/463, IIS 440) quedan fuera — no están en ningún RFC y su significado cambia por fabricante. Consulta su documentación.
¿Por qué el campo 'cuándo' está vacío en algunos?
Si el código es obvio por nombre (200 OK, 500 Internal Server Error) o solo aparece en contextos especiales, basta con el resumen. Solo aparece cuando hay algo que vale la pena destacar.

Herramientas relacionadas

Visor de Diferencias de JSON

Compara dos documentos JSON estructuralmente — mira exactamente qué claves se añadieron, quitaron o cambiaron.

Desarrollo 0 0

Constructor de Encabezado Cache-Control

Construye un encabezado HTTP Cache-Control desde un checklist visual — frescura, revalidación, inmutabilidad y los presets comunes.

Red 0 0

Codificador / Decodificador de HTTP Basic Auth

Codifica `usuario:contraseña` en la cabecera `Authorization: Basic` Base64 — o pega una cabecera existente para ver quién está dentro.

Red 0 0

Referencia de Cabeceras HTTP

Referencia buscable de ~50 cabeceras HTTP estándar de petición, respuesta, CORS, caché, seguridad y cookie.

Desarrollo 0 0

Referencia de Métodos HTTP

Carta rápida por método HTTP (GET, POST, PUT, DELETE, PATCH, …) — seguridad, idempotencia, cacheabilidad, y si se permiten cuerpos de petición / respuesta.

Desarrollo 0 0

Referencia de URIs /.well-known/*

Catálogo buscable de well-known URIs registrados con IANA — `security.txt`, `openid-configuration`, `apple-app-site-association`, `acme-challenge` y 30+ más, con referencias RFC y casos de uso.

Red 0 0