TestingAPIs is still being built. If something breaks, email support@testingapis.com.

HTTP status codes

Every registered HTTP status code, what it means, when you see it and where it is defined.

100ContinueThe server received the request headers and the client should send the body.
101Switching ProtocolsThe server is switching to the protocol the client asked for in the Upgrade header.
102ProcessingThe server accepted the request and is still working on it.
103Early HintsHeaders sent ahead of the final response so the client can start preloading resources.
104Upload Resumption SupportedThe server supports resuming this upload if it is interrupted.
200OKThe request succeeded.
201CreatedThe request succeeded and created a new resource.
202AcceptedThe request was accepted for processing, which hasn't finished.
203Non-Authoritative InformationSuccess, but a proxy changed the response the origin server sent.
204No ContentThe request succeeded and there is no body.
205Reset ContentSuccess; the client should reset the form or view that sent the request.
206Partial ContentThe response holds only the byte range the client asked for.
207Multi-StatusThe body holds separate status codes for several operations.
208Already ReportedMembers of this collection were already listed earlier in the same 207 response.
226IM UsedThe response is a delta applied to the current instance, not the full resource.
300Multiple ChoicesThe resource has several representations and the client should choose one.
301Moved PermanentlyThe resource has a new permanent URL, given in the Location header.
302FoundThe resource is temporarily at the URL in the Location header.
303See OtherThe result is at another URL, which the client should fetch with GET.
304Not ModifiedThe cached copy is still valid, so no body is sent.
305Use ProxyThe resource must be accessed through the proxy in the Location header.
306(Unused)Reserved; it was once used for Switch Proxy and is no longer used.
307Temporary RedirectThe resource is temporarily at another URL; repeat the request there with the same method and body.
308Permanent RedirectThe resource has moved permanently; repeat the request at the new URL with the same method and body.
400Bad RequestThe server can't process the request because it is malformed.
401UnauthorizedThe request has no valid credentials for this resource.
402Payment RequiredReserved for future use.
403ForbiddenThe server understood the request but refuses to allow it.
404Not FoundThe server has nothing at this URL.
405Method Not AllowedThe resource exists but doesn't support this HTTP method.
406Not AcceptableThe server can't produce a response in any format the Accept headers allow.
407Proxy Authentication RequiredThe client must authenticate with the proxy first.
408Request TimeoutThe server gave up waiting for the client to finish sending the request.
409ConflictThe request conflicts with the current state of the resource.
410GoneThe resource existed but has been removed permanently.
411Length RequiredThe server needs a Content-Length header.
412Precondition FailedA condition in the request headers, such as If-Match, is false.
413Content Too LargeThe request body is larger than the server accepts.
414URI Too LongThe URL is longer than the server accepts.
415Unsupported Media TypeThe server doesn't accept the body's format.
416Range Not SatisfiableThe requested byte range is outside the resource.
417Expectation FailedThe server can't meet the Expect header.
418I'm a teapotA joke code from RFC 2324, kept reserved as "(Unused)" because so much software already recognizes it.
421Misdirected RequestThe request reached a server that can't answer for this host.
422Unprocessable ContentThe request is well formed but its content fails validation.
423LockedThe resource is locked.
424Failed DependencyThe request failed because a request it depended on failed.
425Too EarlyThe server won't process a request that might be replayed.
426Upgrade RequiredThe client must switch to another protocol, named in the Upgrade header.
428Precondition RequiredThe server requires a conditional request, such as one with If-Match.
429Too Many RequestsThe client has sent too many requests in a given time and is being rate limited.
431Request Header Fields Too LargeThe headers, or one header, are too large.
451Unavailable For Legal ReasonsThe resource can't be served for legal reasons.
500Internal Server ErrorThe server hit an unexpected condition.
501Not ImplementedThe server doesn't support the functionality needed, such as the request method.
502Bad GatewayA gateway or proxy got an invalid response from the server behind it.
503Service UnavailableThe server can't handle the request right now.
504Gateway TimeoutA gateway or proxy didn't get a response from the server behind it in time.
505HTTP Version Not SupportedThe server doesn't support the HTTP version of the request.
506Variant Also NegotiatesContent negotiation is misconfigured on the server.
507Insufficient StorageThe server can't store what it needs to complete the request.
508Loop DetectedThe server found an infinite loop while processing the request.
510Not ExtendedThe request needs an HTTP extension the server requires.
511Network Authentication RequiredThe client must authenticate to get network access.
419Page ExpiredLaravelThe CSRF token is missing or expired.
420Enhance Your CalmTwitter (historical)The client is being rate limited.
444No Responsenginxnginx closed the connection without sending a response.
494Request Header Too Largenginxnginx's code for headers over its buffer limits.
495SSL Certificate ErrornginxThe client certificate failed verification.
496SSL Certificate RequirednginxA required client certificate wasn't sent.
497HTTP Request Sent to HTTPS PortnginxA plain HTTP request reached a port that expects TLS.
499Client Closed RequestnginxThe client closed the connection before nginx sent the response.
509Bandwidth Limit ExceededApache / cPanelThe site has used up its bandwidth allowance.
520Web Server Returned an Unknown ErrorCloudflareThe origin server returned something Cloudflare couldn't use.
521Web Server Is DownCloudflareThe origin server refused Cloudflare's connection.
522Connection Timed OutCloudflareCloudflare couldn't establish a TCP connection to the origin in time.
523Origin Is UnreachableCloudflareCloudflare can't reach the origin server.
524A Timeout OccurredCloudflareCloudflare connected to the origin, but it didn't respond in time.
525SSL Handshake FailedCloudflareThe TLS handshake between Cloudflare and the origin failed.
526Invalid SSL CertificateCloudflareCloudflare couldn't validate the origin's certificate.
530Origin DNS ErrorCloudflareCloudflare returns 530 together with a 1xxx error, most often 1016 (origin DNS error).

Select a code

Pick a code from the list to see when it is used, the specification that defines it and a command to try it. Use the arrow keys to move through the list.
64 registered codes · 17 unofficial

What are HTTP status codes?

Every HTTP response starts with a three-digit status code that says what happened to the request. The first digit gives the class: 1xx is informational, 2xx means success, 3xx means redirection, 4xx means the request was wrong and 5xx means the server failed.

The codes are defined in RFC 9110, HTTP Semantics, which replaced RFC 7231 in 2022, and in a few other RFCs such as RFC 6585 for 429 Too Many Requests. IANA keeps the official registry. RFC 9110 renamed two codes: 413 is now Content Too Large (formerly Payload Too Large) and 422 is Unprocessable Content (formerly Unprocessable Entity). The numbers and their behavior didn't change.

Some codes you meet aren't in the registry. nginx logs 499 when a client closes the connection before the response is ready, Cloudflare sends 520 to 526 when it can't get a usable response from the origin server, and Laravel sends 419 when a form's CSRF token has expired. They are listed separately, marked unofficial.

The status code is the first thing an API test should check, because the rest of the response depends on it. A 201 Created tells you a POST made a new resource, a 404 that the resource doesn't exist, and a 500 that the server failed, in which case the body may be an error page instead of the JSON you expected.

How to use this tool

  1. 1Browse the list, grouped from 1xx to 5xx with unofficial codes at the end, or filter it with the class buttons.
  2. 2Search by number, name or symptom, such as 404, 5xx, redirect, timeout or a former name like Unprocessable Entity. Press / to jump to the search box from anywhere on the page.
  3. 3Select a code, or move through the list with the arrow keys, to see what it means, when you'd see it, the specification that defines it and related codes to compare it with.
  4. 4Copy the curl command under Try it to make the testingapis.com status endpoint return that code, or copy a link: /tools/http-status/#429 opens 429 directly.

Troubleshooting

A 401 even though you sent a token
The token is expired, malformed, sent in the wrong header, or missing its Bearer prefix. The WWW-Authenticate response header often says which. A 403 instead means the token is valid but lacks permission.
A 415 for a JSON body
The request has no Content-Type: application/json header, so the server doesn't treat the body as JSON. curl's -d sends application/x-www-form-urlencoded unless you set the header.
A POST turns into a GET after a redirect
Clients follow 301 and 302 by repeating the request as a GET without the body. Servers that must keep the method should send 307 or 308.
A 502 or 504 from a load balancer
The proxy in front of the application got no valid answer: 502 when the application crashed or closed the connection, 504 when it took longer than the proxy's timeout. The application's own logs show the cause.
499 in nginx logs
The client gave up before the response was ready: a user navigated away, or a client or upstream proxy timed out. Slow backend requests are the usual cause.

Frequently asked questions

What is the difference between 401 and 403?

401 Unauthorized means the server doesn't know who you are: credentials are missing, expired or wrong. 403 Forbidden means it knows who you are, but that identity isn't allowed to do this. Logging in again can fix a 401, not a 403.

Should an API return 400 or 422 for invalid input?

Both are used. A common convention is 400 for a request the server can't read at all, such as malformed JSON, and 422 for well-formed data that breaks a rule, such as a missing required field or an invalid email.

What is the difference between 502, 503 and 504?

All three usually come from a proxy or load balancer in front of the application. 502 Bad Gateway means it got an invalid response from the server behind it, 503 Service Unavailable means the service is overloaded or down for maintenance, and 504 Gateway Timeout means the server behind it didn't answer in time.

Which redirect code should I use?

301 and 308 are permanent, 302 and 307 temporary. 307 and 308 require the client to repeat the request with the same method and body, while clients usually turn a POST into a GET after a 301 or 302. Use 303 See Other to send a client to a results page after a POST.

Is 418 I'm a teapot a real status code?

It comes from RFC 2324, an April Fools' joke from 1998 about controlling coffee pots. RFC 9110 lists 418 as unused but reserved, because so much software already recognizes it. It isn't meant for real errors.

How can I test how my app handles a specific status code?

Call an endpoint that returns the code you ask for. GET https://api.testingapis.com/api/status/503 responds with a 503 and the headers that status normally carries, such as Retry-After. Any code from 200 to 599 works.

Related