HTTP status codes: what every code category means
1xx informational, 2xx success, 3xx redirection, 4xx client errors, 5xx server errors, 301 vs 302, 401 vs 403, 404 vs 410, 429 rate limiting
HTTP Status Codes
Status codes are a three-digit contract between server and client. The first digit tells you the category. The rest gives you specifics.
The five categories
1xx — Informational. Rare. 100 Continue tells a client it can proceed sending a large request body after the server has validated the request headers.
2xx — Success. 200 OK (request fulfilled), 201 Created (POST succeeded — check the Location header for the new resource URL), 204 No Content (DELETE or PUT succeeded, no response body).
3xx — Redirection. 301 Moved Permanently (update bookmarks — browsers cache this indefinitely), 302 Found (temporary redirect, not cached), 304 Not Modified (your cached version is still valid, no body sent).
4xx — Client error. The request was malformed or unauthorized. 400 Bad Request, 401 Unauthorized (not authenticated — misleading name), 403 Forbidden (authenticated but not permitted), 404 Not Found, 422 Unprocessable Entity (validation failed), 429 Too Many Requests (rate limited).
5xx — Server error. The server failed despite a valid request. 500 Internal Server Error (unhandled exception), 502 Bad Gateway (upstream server unreachable), 503 Service Unavailable (overloaded or maintenance mode), 504 Gateway Timeout.
# Key distinction: 401 vs 403
401: "Who are you?" — No valid credentials. Send authentication.
403: "I know who you are. You cannot do this." — Correct credentials, wrong permissions.