Ir para o conteúdo
AZ Tools

Referência de Códigos de Status HTTP

Mais de 60 códigos de resposta HTTP padronizados, de 100 Continue a 511 Network Authentication Required, com resumo em uma linha, referência RFC, uso recomendado e nota de 'armadilha' para códigos comumente mal utilizados (401 vs 403, 301 cacheado para sempre, 400 vs 422, etc). Filtre por classe (1xx informativos, 2xx sucesso, 3xx redirecionamento, 4xx cliente, 5xx servidor) ou busque por código, nome, resumo e notas.

—

Resultados: 61

  • 100Continue

    Server received headers; client should send the body.

    RFC: RFC 9110 §15.2.1

  • 101Switching Protocols

    Server agrees to switch protocols (e.g., HTTP/2, WebSocket).

    Quando: WebSocket upgrade handshakes.

    RFC: RFC 9110 §15.2.2

  • 102Processing

    WebDAV: request received but no response yet.

    RFC: RFC 2518

  • 103Early Hints

    Preload hints sent before the final response.

    Quando: Send Link: rel=preload for critical assets before the slow backend reply lands.

    RFC: RFC 8297

  • 200OK

    Standard success response with a body.

    RFC: RFC 9110 §15.3.1

  • 201Created

    Resource was created; include Location header pointing to it.

    Quando: POST that creates a new resource. Body is optional.

    RFC: RFC 9110 §15.3.2

  • 202Accepted

    Request accepted for async processing; no result yet.

    Quando: Long-running jobs — return a status URL for the client to poll.

    RFC: RFC 9110 §15.3.3

  • 203Non-Authoritative Information

    Response was transformed by a proxy.

    RFC: RFC 9110 §15.3.4

  • 204No Content

    Success but no body to send.

    Quando: DELETE success, PUT with no useful body, preflight OK.

    Armadilha: MUST NOT include a message body. Some libraries error if you do.

    RFC: RFC 9110 §15.3.5

  • 205Reset Content

    Success; client should reset the document view (clear form).

    RFC: RFC 9110 §15.3.6

  • 206Partial Content

    Range request was honored; partial body follows.

    Quando: Resumable downloads, video seek.

    RFC: RFC 9110 §15.3.7

  • 207Multi-Status

    WebDAV multi-resource batched results.

    RFC: RFC 4918

  • 208Already Reported

    WebDAV: bindings already enumerated earlier in the response.

    RFC: RFC 5842

  • 226IM Used

    Delta encoding response.

    RFC: RFC 3229

  • 300Multiple Choices

    Multiple resources match; client should pick one.

    RFC: RFC 9110 §15.4.1

  • 301Moved Permanently

    Resource has a new permanent URL. Caches forever.

    Quando: Domain migration, URL restructure.

    Armadilha: Browsers cache 301 aggressively — fixing a wrong one is painful. Test with 302 first.

    RFC: RFC 9110 §15.4.2

  • 302Found

    Temporary redirect (legacy semantics, method may change).

    Armadilha: Historically rewrote POST→GET. Use 303 or 307 for explicit method-preservation semantics.

    RFC: RFC 9110 §15.4.3

  • 303See Other

    Redirect that always becomes a GET.

    Quando: POST/Redirect/GET pattern after form submit.

    RFC: RFC 9110 §15.4.4

  • 304Not Modified

    Conditional request: cached copy is still fresh.

    Quando: Response to If-None-Match / If-Modified-Since.

    Armadilha: MUST NOT include a body.

    RFC: RFC 9110 §15.4.5

  • 307Temporary Redirect

    Temporary; method and body must be preserved.

    RFC: RFC 9110 §15.4.8

  • 308Permanent Redirect

    Permanent; method and body must be preserved.

    Quando: POSTs that must survive a permanent move. Prefer over 301 for API endpoints.

    RFC: RFC 9110 §15.4.9

  • 400Bad Request

    Generic malformed request the server cannot parse.

    Armadilha: Don't use 400 for valid syntax with bad semantics — use 422 instead.

    RFC: RFC 9110 §15.5.1

  • 401Unauthorized

    Authentication required or failed. Must include WWW-Authenticate.

    Armadilha: Misnamed historically — means "unauthenticated". Use 403 for "authenticated but not allowed".

    RFC: RFC 9110 §15.5.2

  • 402Payment Required

    Reserved for future use; some APIs use for billing failures.

    RFC: RFC 9110 §15.5.3

  • 403Forbidden

    Authenticated but the action is not allowed for this principal.

    Quando: Authorization failure, geo-block, or "you cannot do this regardless of auth".

    RFC: RFC 9110 §15.5.4

  • 404Not Found

    Resource does not exist (or you are hiding it).

    Quando: Often returned instead of 403 to avoid disclosing existence.

    RFC: RFC 9110 §15.5.5

  • 405Method Not Allowed

    Resource exists but does not support this verb. MUST include Allow header.

    RFC: RFC 9110 §15.5.6

  • 406Not Acceptable

    No representation matches the Accept headers.

    RFC: RFC 9110 §15.5.7

  • 407Proxy Authentication Required

    Like 401 but for proxies. Must include Proxy-Authenticate.

    RFC: RFC 9110 §15.5.8

  • 408Request Timeout

    Server gave up waiting for the request to finish.

    RFC: RFC 9110 §15.5.9

  • 409Conflict

    Request collides with current state (e.g., edit conflict, duplicate).

    Quando: Unique-key violations on creation, version mismatch on update.

    RFC: RFC 9110 §15.5.10

  • 410Gone

    Resource permanently removed with no forwarding address.

    Quando: Use over 404 when you want crawlers/clients to drop the URL permanently.

    RFC: RFC 9110 §15.5.11

  • 411Length Required

    Server requires Content-Length and the request omitted it.

    RFC: RFC 9110 §15.5.12

  • 412Precondition Failed

    If-Match / If-Unmodified-Since check failed.

    Quando: Optimistic concurrency control on updates.

    RFC: RFC 9110 §15.5.13

  • 413Content Too Large

    Body exceeds the server limit. Formerly "Payload Too Large".

    RFC: RFC 9110 §15.5.14

  • 414URI Too Long

    URL exceeds server limit (commonly ~8KB).

    RFC: RFC 9110 §15.5.15

  • 415Unsupported Media Type

    Content-Type is not supported by this endpoint.

    RFC: RFC 9110 §15.5.16

  • 416Range Not Satisfiable

    Range header asks for bytes outside the resource.

    RFC: RFC 9110 §15.5.17

  • 417Expectation Failed

    Server cannot meet the Expect: header requirements.

    RFC: RFC 9110 §15.5.18

  • 418I'm a teapot

    April-fools status (RFC 2324). Returned by some debugging or honeypot endpoints.

    RFC: RFC 2324

  • 421Misdirected Request

    Request was routed to a server that cannot produce a response (e.g., wrong SNI).

    RFC: RFC 9110 §15.5.20

  • 422Unprocessable Content

    Syntactically valid but semantically incorrect (e.g., validation failure).

    Quando: Form-level validation errors on a JSON API.

    RFC: RFC 9110 §15.5.21

  • 423Locked

    WebDAV: resource is locked.

    RFC: RFC 4918

  • 424Failed Dependency

    WebDAV: a previous request in the chain failed.

    RFC: RFC 4918

  • 425Too Early

    Server refuses replay-vulnerable early data (TLS 1.3 0-RTT).

    RFC: RFC 8470

  • 426Upgrade Required

    Client must upgrade to a different protocol. Include Upgrade header.

    RFC: RFC 9110 §15.5.22

  • 428Precondition Required

    Server requires the request to be conditional (If-Match etc).

    Quando: APIs that demand optimistic-concurrency tokens to prevent lost updates.

    RFC: RFC 6585

  • 429Too Many Requests

    Rate-limited. Include Retry-After header.

    RFC: RFC 6585

  • 431Request Header Fields Too Large

    Sum of headers exceeds the server limit.

    RFC: RFC 6585

  • 451Unavailable For Legal Reasons

    Blocked due to legal demand (Fahrenheit 451 reference).

    RFC: RFC 7725

  • 500Internal Server Error

    Unhandled exception or generic server crash.

    Armadilha: Never expose stack traces — log them server-side only.

    RFC: RFC 9110 §15.6.1

  • 501Not Implemented

    Server does not support the requested method at all.

    RFC: RFC 9110 §15.6.2

  • 502Bad Gateway

    Upstream returned an invalid response to the gateway.

    Quando: Load balancer cannot reach origin; origin returned junk.

    RFC: RFC 9110 §15.6.3

  • 503Service Unavailable

    Server temporarily down or overloaded. Should include Retry-After.

    RFC: RFC 9110 §15.6.4

  • 504Gateway Timeout

    Gateway gave up waiting for upstream.

    RFC: RFC 9110 §15.6.5

  • 505HTTP Version Not Supported

    Server does not support the HTTP version in the request.

    RFC: RFC 9110 §15.6.6

  • 506Variant Also Negotiates

    Transparent content negotiation is misconfigured.

    RFC: RFC 2295

  • 507Insufficient Storage

    WebDAV: server cannot store the representation.

    RFC: RFC 4918

  • 508Loop Detected

    WebDAV: infinite loop while processing.

    RFC: RFC 5842

  • 510Not Extended

    Further extensions required to fulfill the request.

    RFC: RFC 2774

  • 511Network Authentication Required

    Captive portal: log in to the network first.

    Quando: Public Wi-Fi splash pages.

    RFC: RFC 6585

Como usar

  1. Digite um código, nome ou qualquer palavra na busca (ex.: "redirect", "rate limit", "422").
  2. Opcionalmente filtre por classe com os chips coloridos.
  3. Leia resumo, quando usar, armadilhas e a referência RFC de cada resultado.

Perguntas frequentes

Por que destacar 'armadilha' em alguns códigos?
Alguns códigos são mal usados rotineiramente. 401 significa 'não autenticado' mas é lido como 'não autorizado'; 301 fica cacheado no navegador praticamente para sempre; 400 vs 422 é discussão sem fim. As notas marcam armadilhas que pegam times em code review ou postmortem.
Inclui códigos WebDAV?
Sim — 102, 207, 208, 423, 424, 507, 508 com a RFC. Mesmo sem usar WebDAV, libs e proxies às vezes expõem; vale conhecer o significado.
E códigos não-padrão (Cloudflare 520-527 etc.)?
Códigos específicos de fornecedor (Cloudflare 520-527, AWS 460/463, IIS 440) ficam de fora — não estão em RFC e variam por fornecedor. Consulte a doc do fornecedor.
Por que o campo 'quando' está vazio em alguns?
Se o código é óbvio pelo nome (200 OK, 500 Internal Server Error) ou só aparece em contextos especiais, o resumo basta. Só aparece quando há algo que merece destaque.

Ferramentas relacionadas

Visualizador de Diferenças de JSON

Compare dois documentos JSON estruturalmente — veja exatamente quais chaves foram adicionadas, removidas ou alteradas.

Desenvolvimento 0 0

Construtor de Cabeçalho Cache-Control

Construa um cabeçalho HTTP Cache-Control a partir de uma checklist visual — frescor, revalidação, imutabilidade e os presets comuns.

Rede 0 0

Codificador / Decodificador de HTTP Basic Auth

Codifica `usuário:senha` no cabeçalho `Authorization: Basic` Base64 — ou cole um cabeçalho existente pra ver quem tá dentro.

Rede 0 0

Referência de Cabeçalhos HTTP

Referência pesquisável de ~50 cabeçalhos HTTP padrão de requisição, resposta, CORS, cache, segurança e cookie.

Desenvolvimento 0 0

Referência de Métodos HTTP

Cartão rápido por método HTTP (GET, POST, PUT, DELETE, PATCH, …) — segurança, idempotência, cacheabilidade, e se corpos de request / response são permitidos.

Desenvolvimento 0 0

Referência de URIs /.well-known/*

Catálogo pesquisável de well-known URIs registrados com IANA — `security.txt`, `openid-configuration`, `apple-app-site-association`, `acme-challenge` e 30+ mais, com referências RFC e casos de uso.

Rede 0 0