HTTP Status Codes 29 Codes Documented

4XX — Client Error

The client appears to have made an error, such as requesting a resource that does not exist (404) or lacking proper authentication (401).

HTTP 400

Bad Request

This request was not understood or could not be processed by the server due to malformed request syntax, invalid request message framing, or deceptive routing.
HTTP 401

Unauthorized

Semantically "Unauthenticated". The request requires user authentication credentials that are missing or invalid. The server must provide a WWW-Authenticate header field.
HTTP 402

Payment Required

Reserved for digital payment schemes. Increasingly utilized by modern paid developer APIs, web monetization standards, and subscription gateways.
HTTP 403

Forbidden

The server understood the request, but refuses to authorize it. Unlike 401, authentication credentials will not help because the client lacks access privileges to this resource.
HTTP 404

Not Found

The origin server cannot find a current representation for the target resource or is not willing to disclose that one exists. (If a resource has been permanently removed, 410 "Gone" should be used).
HTTP 405

Method Not Allowed

The request method is recognized by the server but is not supported by the target resource (e.g., attempting a POST or DELETE on a static file). The response must include an "Allow" header listing permitted methods.
HTTP 406

Not Acceptable

The target resource does not have a representation matching the client's content negotiation Accept headers (e.g. Accept-Charset, Accept-Language, or Accept MIME types).
HTTP 407

Proxy Authentication Required

Similar to 401 (Unauthorized), but authentication must be performed with an intermediate proxy mediating access. The proxy must send a Proxy-Authenticate header.
HTTP 408

Request Timeout

The server timed out waiting for the client to send the complete request. The connection was closed by the server and the client may repeat the request without modification.
HTTP 409

Conflict

The request could not be completed due to a conflict with the current state of the target resource (e.g., version control merge conflicts or editing an out-of-date resource).
HTTP 410

Gone

This resource has been permanently removed with no forwarding address. Search engines immediately de-index 410 URLs and do not retry crawling them.
HTTP 411

Length Required

The server refuses to process the request without a defined Content-Length header. The client may repeat the request by adding a valid Content-Length header field.
HTTP 412

Precondition Failed

One or more conditions given in the request header fields (such as If-Match or If-Unmodified-Since) evaluated to false when tested on the server.
HTTP 413

Content Too Large

The server refuses to process the request because the payload body is larger than the server is willing or able to process (formerly "Request Entity Too Large").
HTTP 414

URI Too Long

The request-target URI is longer than the server is willing to interpret (formerly "Request-URI Too Long"). Commonly caused when form submissions convert large POST bodies into oversized GET query strings.
HTTP 415

Unsupported Media Type

The origin server refuses to service the request because the payload is in a format not supported by this method on the target resource (e.g. sending XML to an endpoint expecting JSON).
HTTP 416

Range Not Satisfiable

None of the ranges in the request's Range header field overlap the current extent of the selected resource (e.g. requesting bytes beyond the total file length).
HTTP 417

Expectation Failed

The expectation given in the request's "Expect" header field (such as Expect: 100-continue) could not be met by the server or its intermediate proxies.
HTTP 418

I'm a teapot

Proprietary
Defined in 1998 as an IETF April Fools' joke in RFC 2324 (Hyper Text Coffee Pot Control Protocol). The RFC specifies this code should be returned by teapots requested to brew coffee. Famous Easter egg implemented across the web and popular APIs.
HTTP 421

Misdirected Request

The request was directed at a server that is not able to produce a response (common with HTTP/2 and HTTP/3 connection reuse when a TLS connection does not cover the requested hostname).
HTTP 422

Unprocessable Content

The server understands the content type of the request entity and the syntax is correct, but was unable to process the contained instructions due to semantic validation errors (formerly "Unprocessable Entity").
HTTP 423

Locked

The resource that is being accessed is currently locked against modification (WebDAV).
HTTP 424

Failed Dependency

The request failed because it depended on another action and that action failed (WebDAV).
HTTP 425

Too Early

Indicates that the server is unwilling to risk processing a request that might be replayed in early data over 0-RTT TLS 1.3 connections.
HTTP 426

Upgrade Required

The client should switch to a different protocol such as TLS 1.3 or HTTP/2, as specified in the response Upgrade header.
HTTP 428

Precondition Required

The origin server requires the request to be conditional. Intended to prevent the "lost update" problem where multiple clients modify resource state without synchronization.
HTTP 429

Too Many Requests

The user has sent too many requests in a given amount of time ("rate limiting"). Often accompanied by a Retry-After header indicating how long to wait before trying again.
HTTP 431

Request Header Fields Too Large

The server is unwilling to process the request because either an individual header field, or all the header fields collectively, are too large.
HTTP 451

Unavailable For Legal Reasons

Access to the resource is denied due to a legal demand, court order, or government censorship. The code 451 was chosen as an homage to Ray Bradbury's novel Fahrenheit 451.