HTTP Status Code Lookup

401 Unauthorized means the client is not authenticated — the server doesn't know who you are (despite the misleading name, it means 'unauthenticated'). 403 Forbidden means the client is authenticated but lacks permission to access the resource.

Use 404 when a resource doesn't exist or you don't want to reveal its existence. Use 410 Gone when a resource has been permanently deleted and you want to signal this intentionally — search engines will de-index 410 pages faster than 404s.

Both are permanent redirects, but 301 allows browsers to change POST to GET on the redirect, while 308 preserves the original method. Use 308 when moving a POST API endpoint permanently.

Use 400 for syntactically malformed requests (invalid JSON, missing required headers). Use 422 for requests that are syntactically valid but fail semantic/business validation (invalid email format, end date before start date, etc.).

When returning 429, include a Retry-After header (seconds or HTTP-date) and optionally X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers for better developer experience.