HTTP Status & MIME Cheat-Sheet
Searchable HTTP status code & MIME type cheat-sheet, color-coded by class with click-to-copy.
Showing 62 / 62 · click a row to copy
| Code | Reason phrase | Description |
|---|---|---|
| 100 | Continue | Request received; client may continue. |
| 101 | Switching Protocols | Server is switching protocols per Upgrade header. |
| 102 | Processing | Request received but still processing (WebDAV). |
| 103 | Early Hints | Preload hints sent before final response. |
| 200 | OK | Request succeeded. |
| 201 | Created | Resource created successfully. |
| 202 | Accepted | Request accepted, processing not finished. |
| 203 | Non-Authoritative Information | Returned meta is from a copy, not origin. |
| 204 | No Content | Success but no body returned. |
| 205 | Reset Content | Reset the document view. |
| 206 | Partial Content | Range request fulfilled partially. |
| 207 | Multi-Status | Multiple status codes for sub-requests (WebDAV). |
| 208 | Already Reported | Binding members already enumerated (WebDAV). |
| 226 | IM Used | Response is an instance-manipulation result. |
| 300 | Multiple Choices | Multiple representations available. |
| 301 | Moved Permanently | Resource moved permanently to a new URL. |
| 302 | Found | Resource temporarily under a different URL. |
| 303 | See Other | Retrieve the resource via GET at another URL. |
| 304 | Not Modified | Cached copy still valid; not modified. |
| 305 | Use Proxy | Resource must be accessed through a proxy. |
| 307 | Temporary Redirect | Temporary redirect; keep request method. |
| 308 | Permanent Redirect | Permanent redirect; keep request method. |
| 400 | Bad Request | Malformed request syntax. |
| 401 | Unauthorized | Authentication required or failed. |
| 402 | Payment Required | Reserved for future payment use. |
| 403 | Forbidden | Authenticated but not allowed. |
| 404 | Not Found | Resource not found. |
| 405 | Method Not Allowed | HTTP method not allowed for this resource. |
| 406 | Not Acceptable | No representation matches Accept headers. |
| 407 | Proxy Authentication Required | Must authenticate with the proxy first. |
| 408 | Request Timeout | Server timed out waiting for the request. |
| 409 | Conflict | Request conflicts with current state. |
| 410 | Gone | Resource permanently removed. |
| 411 | Length Required | Content-Length header required. |
| 412 | Precondition Failed | A request precondition failed. |
| 413 | Payload Too Large | Request body too large. |
| 414 | URI Too Long | Request URI too long. |
| 415 | Unsupported Media Type | Media type not supported. |
| 416 | Range Not Satisfiable | Requested range cannot be satisfied. |
| 417 | Expectation Failed | Expect header cannot be met. |
| 418 | I'm a teapot | Joke code from RFC 2324 (April Fools). |
| 421 | Misdirected Request | Request sent to a server that cannot respond. |
| 422 | Unprocessable Entity | Semantic errors in request (validation). |
| 423 | Locked | Resource is locked (WebDAV). |
| 424 | Failed Dependency | Depends on a failed request (WebDAV). |
| 425 | Too Early | Server unwilling to risk replay. |
| 426 | Upgrade Required | Client must switch to a different protocol. |
| 428 | Precondition Required | Request must be conditional. |
| 429 | Too Many Requests | Rate limit exceeded. |
| 431 | Request Header Fields Too Large | Header fields too large. |
| 451 | Unavailable For Legal Reasons | Blocked for legal reasons. |
| 500 | Internal Server Error | Generic server error. |
| 501 | Not Implemented | Server lacks the requested functionality. |
| 502 | Bad Gateway | Invalid response from upstream server. |
| 503 | Service Unavailable | Server overloaded or under maintenance. |
| 504 | Gateway Timeout | Upstream server timed out. |
| 505 | HTTP Version Not Supported | HTTP version not supported. |
| 506 | Variant Also Negotiates | Content negotiation config error. |
| 507 | Insufficient Storage | Server out of storage (WebDAV). |
| 508 | Loop Detected | Infinite loop detected (WebDAV). |
| 510 | Not Extended | Further extensions required. |
| 511 | Network Authentication Required | Client must authenticate to gain access. |
How to use
Purpose
HTTP status code reference covering 1xx / 2xx / 3xx / 4xx / 5xx (100 Continue through 511 Network Authentication Required). For each code: official meaning, when to return it, how clients should handle it. Distinguishes common vs obscure codes, RESTful API recommended usage, browser-behavior relationship. Common for API design reference, endpoint error triage, interview review, HTTP protocol learning. Data stored locally, no network calls.
Steps
- Input a code (200/404) or browse by category
- Right pane shows official definition + meaning + when returned
- Common-level marking: very high (200/404/500), common (401/403/502), obscure (418/451)
- RESTful usage: which codes each verb (GET/POST/PUT/DELETE) typically returns
- Client handling: what frontend should do for each code
- Related RFCs: RFC 7231 / 9110 references
- Similar code comparisons: 401 vs 403, 301 vs 302, 502 vs 504
- One-click copy code + description
FAQ
- 401 vs 403?
- 401 Unauthorized: not logged in or token expired. Client should redirect to login. 403 Forbidden: logged in but no permission. Client should show "no permission" — relogin will not help. Naming is misleading: 401 should have been "Unauthenticated", 403 is the real "Unauthorized".
- 301 vs 302 — which is permanent?
- 301 Moved Permanently: permanent redirect; browsers cache the new location (skipping the old next time). 302 Found: temporary; always goes through the old URL. SEO: 301 transfers SEO weight to the new URL, 302 does not. Use 301 for domain change / permanent moves; 302 for A/B testing or temporary maintenance.
- 502 vs 504?
- 502 Bad Gateway: upstream returned an invalid response (service crashed, protocol error). E.g., PHP-FPM behind nginx is down → 502. 504 Gateway Timeout: upstream did not respond in time. 502 is usually a process issue (restart service); 504 is upstream slowness (check slow queries / network).
- POST creating a resource — return 200 or 201?
- RESTful recommends 201 Created (explicit "creation success"), with a Location header pointing to the new resource URI. Returning 200 is common too ("success without emphasizing creation"). Strict REST projects use 201; business-first projects either is fine — be consistent within the team.
- Why do some APIs return 200 with error info in the body?
- Anti-REST design. Arguments for: 1) browsers handle 4xx/5xx specially (some scenarios do not enter success callback); 2) China mobile-app history; 3) custom error codes richer than HTTP status. REST counterargument: HTTP status codes exist precisely for success/failure semantics. In practice, depends on team / business — RESTful designs integrate more smoothly with third parties.
Use cases
- API design: decide which code to return on failure
- Endpoint triage: API returns 5xx, look up what it means
- Frontend error handling: decide what to show the user per code
- Interview review: common HTTP code questions
- Teaching: explain HTTP codes to newcomers
Use cases
API design, endpoint triage, frontend error handling, interview review, HTTP teaching. Backend, frontend, QA, support, interviewees. Common-level marking, RESTful recommendation, similar-code comparison, client-handling guidance are the differentiators.