HTTP Status Codes

The five classes

• 1xx Informational — interim responses; the request continues.
• 2xx Success — the request worked; 200 is everyday success, 201 means something was created, 204 means success with nothing to return.
• 3xx Redirection — look elsewhere; 301 is permanent (SEO juice moves), 302/307 temporary, 304 means "your cached copy is still good".
• 4xx Client errors — the request is at fault: 400 malformed, 401 not signed in, 403 signed in but not allowed, 404 no such thing, 429 slow down.
• 5xx Server errors — the server is at fault: 500 crashed, 502/504 a gateway couldn't reach the backend, 503 temporarily overloaded.

Frequently asked questions

401 vs 403 — which do I return?

401 when the user isn't authenticated (missing/invalid credentials — "who are you?"); 403 when they're authenticated but not allowed ("I know who you are, and no"). Some APIs return 404 instead of 403 to avoid confirming a resource exists.

Is 418 real?

Yes — "I'm a teapot" comes from a 1998 April Fools RFC (HTCPCP). It's a joke code, but so beloved that attempts to retire it failed; many frameworks still ship it.