HTTP Status Code Explorer

Use 200 OK for general success with a response body. Use 201 Created when a POST creates a new resource — include a Location header pointing to the new resource. Use 204 No Content for successful operations that return nothing (e.g. DELETE, or PATCH when you don't need to return the updated state).

401 Unauthorized means the request lacks valid authentication credentials — the client should authenticate and retry. 403 Forbidden means the server understood the request and the client IS authenticated, but lacks permission to access the resource. In short: 401 = not logged in, 403 = logged in but not allowed.

400 Bad Request covers malformed syntax (invalid JSON, wrong content-type). 422 Unprocessable Entity is for requests that are syntactically correct but semantically invalid — e.g. a valid JSON body where a required field fails business validation. REST APIs often use 400 for both, but GraphQL and some frameworks prefer 422 for validation errors.

429 indicates the client has sent too many requests in a given time window (rate limiting). The response should include a Retry-After header indicating when the client can retry. Clients should implement exponential backoff and respect this header to avoid being permanently blocked.

Use 502 Bad Gateway when your server received an invalid response from an upstream service it's proxying to. Use 503 Service Unavailable when your server itself is overloaded or temporarily down for maintenance — include a Retry-After header. Use 504 Gateway Timeout when the upstream service didn't respond in time.