About HTTP Status Codes
HTTP status codes are three-digit numbers returned by a server in response to a client's request. They indicate whether a specific HTTP request has been successfully completed and provide information about the nature of the response.
Status Code Categories
1xx - Informational:
The request was received and the process is continuing. These are provisional responses.
2xx - Success:
The request was successfully received, understood, and accepted by the server.
3xx - Redirection:
Further action needs to be taken to complete the request, usually a redirect.
4xx - Client Error:
The request contains bad syntax or cannot be fulfilled by the server. The error is on the client side.
5xx - Server Error:
The server failed to fulfill a valid request. The error is on the server side.
Most Common Status Codes
- 200 OK: Standard successful response
- 201 Created: Resource successfully created
- 204 No Content: Success with no response body
- 301 Moved Permanently: Permanent redirect
- 302 Found: Temporary redirect
- 400 Bad Request: Invalid request syntax
- 401 Unauthorized: Authentication required
- 403 Forbidden: Access denied
- 404 Not Found: Resource doesn't exist
- 429 Too Many Requests: Rate limit exceeded
- 500 Internal Server Error: Server error
- 502 Bad Gateway: Invalid upstream response
- 503 Service Unavailable: Server temporarily unavailable
When to Use Each Status Code
REST API Design:
- GET success: 200 OK
- POST success: 201 Created
- PUT/PATCH success: 200 OK or 204 No Content
- DELETE success: 204 No Content or 200 OK
- Validation error: 422 Unprocessable Entity
- Not found: 404 Not Found
- Unauthorized: 401 Unauthorized
- Forbidden: 403 Forbidden
Best Practices
- Use appropriate status codes for different scenarios
- Don't return 200 OK for errors
- Use 201 Created when creating resources
- Use 204 No Content when there's no response body
- Use 404 Not Found for missing resources
- Use 422 for validation errors, not 400
- Use 429 for rate limiting
- Include error details in response body
- Be consistent across your API
Debugging Tips
- Check browser DevTools Network tab for status codes
- Use curl or Postman to test API endpoints
- Log status codes on both client and server
- Set up monitoring for 4xx and 5xx errors
- Return meaningful error messages with status codes
- Use status codes to trigger retry logic
Frequently Asked Questions
What's the difference between 401 and 403?
401 means authentication is required or failed. 403 means the user is authenticated but doesn't have permission.
When should I use 400 vs 422?
Use 400 for malformed requests (invalid JSON). Use 422 for well-formed requests with semantic errors (validation failures).
What's the difference between 301 and 302?
301 is a permanent redirect (SEO-friendly). 302 is a temporary redirect.
Should I use 200 or 204 for DELETE?
Use 204 No Content if you're not returning a response body. Use 200 OK if you're returning confirmation data.
What does 418 I'm a teapot mean?
It's an April Fools' joke from 1998. Not meant for production use, but some APIs use it for fun.