HTTP Status Code Reference

HTTP status codes are 3-digit numbers returned by a server to indicate the result of a request. They're grouped into 5 classes: 1xx (informational), 2xx (success), 3xx (redirection), 4xx (client error), and 5xx (server error). Every HTTP response includes a status code.

401 Unauthorized means the request lacks valid authentication — the server doesn't know who you are. 403 Forbidden means the server knows who you are, but you don't have permission to access the resource. Use 401 when credentials are missing or invalid; use 403 when the user is authenticated but unauthorized.

Use 404 Not Found when a resource doesn't exist or you don't want to reveal whether it exists. Use 410 Gone when a resource existed but has been permanently deleted — this tells search crawlers to deindex the URL. If you don't track deletions, 404 is fine in most cases.

301 Moved Permanently tells browsers and search engines to permanently update their records — link equity transfers and the redirect is cached. 302 Found is temporary, so browsers keep the original URL and don't cache the redirect. For SEO-safe URL changes, use 301. For login flows or A/B testing, use 302.

429 indicates rate limiting — the client has sent too many requests in a given window. Best practice is to include a Retry-After header indicating when the client can retry. Clients should implement exponential backoff and jitter when they receive 429 responses from APIs.

400 Bad Request is for syntactically malformed requests (invalid JSON, missing Content-Type). 422 Unprocessable Entity is for requests that are syntactically valid but semantically wrong (correct JSON structure, but a field fails validation like 'age' being negative). Most modern APIs use 422 for form/field validation errors.