HTTP Status Codes reference data
Complete reference of HTTP response status codes.
Topic guide
What HTTP Status Codes covers
This category is the reference for how HTTP clients and servers talk: the status codes that summarize a response, the methods that say what a request wants, the headers that carry metadata, and the mechanisms layered on top (authentication, caching, content negotiation, CORS and redirects). The codes and methods are defined by IETF specifications, chiefly RFC 9110, so their meaning is stable, but real servers and APIs bend them. The practical skill is to pick the most specific correct code and to know which behaviors (caching, retries, redirects) a client will infer from it.
Key ideas
- Status code class
- The first digit gives the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error.
- Safe and idempotent methods
- Safe methods (GET, HEAD, OPTIONS) do not change server state. Idempotent methods (those plus PUT and DELETE) have the same effect when repeated, which makes retries safe.
- 401 vs 403
- 401 means authentication is missing or invalid; 403 means the client is authenticated but not allowed.
- Redirect semantics
- 301 and 308 are permanent, 302 and 307 temporary. 307 and 308 preserve the request method; 301 and 302 historically allow clients to change POST to GET.
- Cache validators
- ETag and Last-Modified let a client ask whether its stored copy is still valid and receive 304 Not Modified instead of the full body.
- Content negotiation
- The client states preferences with Accept headers and the server chooses a representation, signaling dependence with Vary.
- CORS
- A browser mechanism that lets a server permit cross-origin requests with Access-Control headers, often after a preflight OPTIONS request.
Common pitfalls
- Returning 200 with an error message in the body. Clients, caches and monitors rely on the status code.
- Using 404 and 403 inconsistently to hide or reveal that a resource exists; decide the policy and apply it uniformly.
- Redirecting with 301 when a temporary move is intended. Browsers and search engines cache permanent redirects aggressively.
- Setting Access-Control-Allow-Origin to * on responses that use credentials; browsers reject that combination.
Using it from an agent
- Retry only idempotent requests and 429, 502, 503 and 504 responses, honoring Retry-After and using exponential backoff with jitter.
- When asked what a code means, give the code, the name, the typical cause and the action the client should take.
- Quote RFC 9110 for definitions of methods and status codes and RFC 9111 for caching.
Start with: Complete HTTP Status Codes Reference · HTTP Methods Reference
Datasets in HTTP Status Codes
-
CORS (Cross-Origin Resource Sharing) Guide
Complete CORS reference: preflight requests, Access-Control headers, credentials, wildcard policies, and common pitfalls.
14 entries -
Complete HTTP Status Codes Reference
Complete reference of all HTTP status codes organized by class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error.
45 entries -
HTTP Authentication Methods
HTTP authentication schemes: Basic, Bearer (JWT), Digest, OAuth 2.0, Mutual TLS, and modern alternatives like WebAuthn and passkeys.
16 entries -
HTTP Cache-Control Directives
Cache-Control directives for browser and shared caches, with example values, intended behavior, and common configuration mistakes.
12 entries -
HTTP Caching: Complete Guide
HTTP caching strategies: Cache-Control directives, ETag/Last-Modified validation, CDN caching, stale-while-revalidate, and browser cache behavior.
12 entries -
HTTP Client Error Status Codes (4xx)
Guide to 4xx client error responses: when to use 400 vs 401 vs 403 vs 404 vs 429, proper error responses, and user experience.
9 entries -
HTTP Conditional Requests and Validators
Conditional request headers, comparison rules, and response outcomes for safe caching and lost-update protection.
8 entries -
HTTP Content Negotiation
HTTP content negotiation: Accept, Accept-Language, Accept-Encoding, Accept-Charset headers, content type selection, and server-driven vs agent-driven negotiation.
15 entries -
HTTP Methods Reference
Standard HTTP request methods: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, TRACE with safety, idempotency, and body characteristics.
9 entries -
HTTP Redirect Status Codes (3xx)
Comprehensive guide to HTTP 3xx redirect codes: when to use 301 vs 302 vs 307 vs 308, SEO implications, and browser behavior.
17 entries -
HTTP Retry Decision Reference
Failure scenarios and retry decisions for HTTP clients, including idempotency, backoff, deadlines, and ambiguous writes.
12 entries -
HTTP Server Error Status Codes (5xx)
Guide to 5xx server error responses: diagnosing 500, 502, 503, 504 errors, retry strategies, and monitoring.
12 entries -
HTTP Status Code Best Practices
Guidelines for proper HTTP status code usage in REST APIs: when to use each code, common mistakes, and industry conventions.
8 entries
Fetch this category
One request returns the category with all of its dataset summaries. Append
?format=yaml or ?format=toon for the other encodings.
GET https://yjtoon.com/api/category/http-status-codes?format=json