HTTP Status Code Lookup

The client should continue sending the request body. Sent in response to an Expect: 100-continue header.

The server is switching protocols as requested by the client's Upgrade header — a WebSocket handshake, for example.

The server accepted the request but hasn't finished it. Used by WebDAV to keep long operations from timing out.

Preliminary response carrying Link headers so the client can preload resources while the final response is prepared.

The request succeeded. The meaning of the body depends on the method — GET returns the resource, POST returns the result of the action.

The request succeeded and created a new resource. The Location header should point to it.

The request was accepted for processing but hasn't completed. Typical for queued or asynchronous work.

The response is a modified version of the origin's payload, usually rewritten by a proxy.

The request succeeded and there is no body to return. Common for DELETE and for PUT updates.

The request succeeded; the client should reset the document view — clear the form that sent the request.

The server is delivering part of the resource in response to a Range header. Used for resumable downloads and media seeking.

The body is an XML document with separate status codes for multiple independent operations (WebDAV).

Members of a WebDAV binding were already enumerated in a previous part of the multi-status response.

The server fulfilled a GET and the response is the result of instance manipulations applied to the current instance.

The request has more than one possible response; the client or user should pick one.

The resource has a new permanent URL in the Location header. Clients and search engines should update their links.

The resource is temporarily at a different URL. Clients historically switch POST to GET — use 307 to avoid that.

Fetch the resource at the Location URL with GET. The usual redirect after a successful POST.

The cached copy is still fresh, so no body is sent. Returned for conditional requests using If-None-Match or If-Modified-Since.

The resource must be accessed through a proxy. Deprecated for security reasons and no longer honoured by browsers.

Same as 302, but the method and body must not be changed when the request is repeated at the new URL.

Same as 301, but the method and body must not be changed when the request is repeated at the new URL.

The server can't parse the request — malformed syntax, invalid framing, or deceptive routing.

Authentication is required or failed. Despite the name it means unauthenticated; the response carries a WWW-Authenticate header.

Reserved for future use. Some APIs return it when a plan limit is hit or a subscription lapsed.

The server understood the request but refuses it. Re-authenticating won't help — unlike 401.

The server has no resource at this URL and won't say whether it ever did.

The resource exists but doesn't support this method. The response must list supported methods in Allow.

No representation matches the request's Accept, Accept-Language, or Accept-Encoding headers.

Like 401, but the client must authenticate with the proxy identified in Proxy-Authenticate.

The server closed an idle connection because the client took too long to send the request.

The request conflicts with the current state of the resource — a concurrent edit or a duplicate unique value.

The resource was deliberately removed and won't come back. A permanent, intentional 404.

The server refuses the request because it has no Content-Length header.

A conditional header such as If-Match or If-Unmodified-Since evaluated to false. The usual optimistic-locking failure.

The request body exceeds the server's limit. Previously called Payload Too Large.

The request target is longer than the server will interpret — often a GET that should have been a POST.

The body's Content-Type isn't supported by the target resource.

The requested Range lies outside the size of the resource.

The expectation in the Expect header can't be met by the server.

An April Fools' joke from the Hyper Text Coffee Pot Control Protocol. Some servers return it for automated or unwanted traffic.

Laravel returns this when a CSRF token has expired and the form must be resubmitted.

Rate limiting on the retired Twitter API v1. Modern APIs use 429 instead.

The request reached a server that can't produce a response for this authority — a connection-reuse mismatch under HTTP/2.

The syntax is valid but the content is semantically wrong. The standard validation-failure code for JSON APIs.

The resource is locked (WebDAV).

The request failed because a request it depended on failed (WebDAV).

The server won't process a request sent in TLS early data, to avoid replay attacks.

The client must switch to a different protocol, listed in the Upgrade header.

The server requires a conditional request so concurrent updates can't silently overwrite each other.

The client is rate limited. A Retry-After header says when to try again.

The headers are too large in total, or one header is — often an oversized cookie.

The session expired and the client must log in again (IIS).

nginx closes the connection without sending a response, typically to drop malicious requests.

Access is denied for legal reasons such as a takedown order or geo-blocking. The number nods to Fahrenheit 451.

nginx's predecessor to 431 for oversized headers.

The client disconnected before nginx could respond. Usually a cancelled request or a client-side timeout.

An unhandled error on the server. The generic catch-all when nothing more specific applies.

The server doesn't support the functionality needed — an unrecognised method, for example.

A gateway or proxy got an invalid response from the upstream server it was talking to.

The server is overloaded or down for maintenance. Should be temporary and may include Retry-After.

A gateway or proxy didn't get a response from the upstream server in time.

The HTTP version used in the request isn't supported by the server.

Content negotiation is misconfigured: the chosen variant is itself a negotiating resource.

The server can't store the representation needed to complete the request (WebDAV).

The server aborted the operation because it found an infinite loop while processing it (WebDAV).

Further extensions to the request are required for the server to fulfil it.

The client must authenticate to get network access — the code behind captive-portal WiFi logins.

Cloudflare got an empty, unknown, or malformed response from the origin server.

Cloudflare could not reach the origin server — the connection was refused.

Cloudflare timed out while opening a TCP connection to the origin server.

Cloudflare cannot reach the origin — often a DNS or routing problem.

Cloudflare connected to the origin but didn't get an HTTP response before the timeout.

The TLS handshake between Cloudflare and the origin server failed.

Cloudflare could not validate the origin server's TLS certificate.

Cloudflare returns 530 alongside a 1xxx error code that carries the real cause.

Used by some proxies to signal that a network connection timed out behind the proxy.