HTTP Status Codes

Request headers received, client should continue sending body.

Server agrees to switch protocols (e.g., HTTP/1.1 → WebSocket).

WebDAV — server processing, no response yet.

Hints (e.g., preload Link headers) sent before final response.

Standard success.

Resource created. Response should include Location header.

Request accepted but not yet processed (async/queued work).

Response from a transforming proxy, not the origin.

Success with no body. Common for DELETE / PUT.

Success — client should reset the document view (form clear).

Range request success. Used in resumable downloads.

WebDAV — multiple resources, each with own status.

Multiple representations available. Rare in practice.

Permanent redirect. Cacheable. SEO favorite for URL changes.

Temporary redirect. Method may change to GET (legacy).

Redirect — explicitly switch to GET. Used after POST (PRG pattern).

Cached version still valid (If-Modified-Since / ETag).

Redirect — keep original method. Modern alternative to 302.

Like 301 but keeps method. Modern alternative.

Malformed syntax or invalid framing.

Authentication required or invalid (despite name — auth, not authz).

Reserved for future use. Sometimes used by payment-gated APIs.

Authenticated but not authorized.

Resource does not exist (or hidden).

Method (GET/POST/...) not supported. Response should include Allow header.

No representation matches Accept headers.

Proxy requires auth.

Server timed out waiting for the request.

Conflict with current state (concurrent edit, version mismatch).

Permanently removed. Stronger than 404 (intentional).

Content-Length header missing.

If-Match / If-Unmodified-Since failed.

Request body exceeds server limit (formerly 'Payload Too Large').

Request URI exceeds server limit.

Server doesn't accept the Content-Type.

Range header out of bounds.

Expect header value not met.

April 1, 1998 RFC 2324 joke. Some servers (Google) actually return it.

Request sent to a server that can't produce a response (HTTP/2 connection coalescing).

Syntax OK but semantically invalid (validation failure).

WebDAV — resource locked.

WebDAV — depended on a request that failed.

Server unwilling to process replay attack risk (TLS 1.3 0-RTT).

Client must upgrade protocol (e.g., HTTP/2).

Server requires conditional request (If-Match) to prevent lost updates.

Rate-limit exceeded. Should include Retry-After header.

Combined header size too large.

Censorship — blocked by law (RFC named after Bradbury's '451').

Unhandled exception or generic server failure.

Server doesn't support the method/feature.

Gateway/proxy got invalid response from upstream.

Overloaded or under maintenance. Retry-After header recommended.

Gateway/proxy timed out waiting for upstream.

Server doesn't support the requested HTTP version.

Transparent content negotiation misconfiguration.

WebDAV — server storage exhausted.

WebDAV — infinite loop in request processing.

Extension required (rarely used).

Captive portal — must authenticate to access network.