HTTP Status Code Lookup

401 Unauthorized means the client is not authenticated — the server doesn't know who you are. Include a WWW-Authenticate header so the client knows how to authenticate. 403 Forbidden means the client is authenticated but lacks permission — the server knows who you are but you're not allowed to access this resource.

Use 404 when a resource doesn't exist. Use 403 when it exists but the user lacks permission. However, returning 404 for a resource that exists (but is forbidden) is a common security practice to avoid leaking information about the existence of private resources — sometimes called 'security through obscurity'.

Both are permanent redirects, but 301 allows browsers to change the HTTP method (typically converting POST to GET), while 308 requires the client to use the same HTTP method as the original request. Use 308 when you're permanently moving a POST endpoint and need the method preserved.

Use 400 Bad Request for syntactically malformed requests (invalid JSON, missing required headers). Use 422 Unprocessable Entity for requests that are syntactically valid but fail semantic/business validation (e.g., end date before start date, invalid email format, value out of allowed range).

When returning 429, you should include a Retry-After header indicating when the client can retry — either as a number of seconds (Retry-After: 60) or an HTTP date. Also consider including X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers for better developer experience.

502 Bad Gateway: your gateway/proxy received an invalid response from an upstream server. 503 Service Unavailable: the server itself is temporarily unavailable (overloaded, maintenance). 504 Gateway Timeout: your gateway/proxy didn't receive a timely response from an upstream server. All three indicate server-side problems and clients may retry.