HTTP Status Code Reference

Request malformed — bad syntax, invalid JSON, missing required field.

Authentication required or failed. Despite the name, this is about AUTHENTICATION — use 403 for authenticated-but-not-permitted.

Reserved for future use. Some APIs use it for quota exhaustion or billing issues.

Server understood the request but refuses. User IS authenticated but lacks permission.

Resource doesn't exist — or server is hiding its existence.

Method known but not supported on this URL. Response MUST include Allow header.

Can't produce a response matching the Accept headers.

Client must authenticate with the proxy.

Server closed an idle connection.

Request conflicts with current state. Common for duplicate creates or edit conflicts.

Permanently removed — use instead of 404 when you know the resource is gone for good.

Content-Length header required.

If-Match / If-Unmodified-Since condition failed.

Request body larger than server allows. (Previously 'Payload Too Large'.)

Request URL longer than server is willing to interpret.

Content-Type not supported. Common when client sends XML to a JSON-only endpoint.

Requested byte range is outside the resource.

Server can't meet the Expect header requirement.

Any attempt to brew coffee with a teapot shall result in 418 I'm a teapot. Kept as a joke status.

Syntactically valid but semantically wrong. Common for validation errors on structured bodies.

Request in TLS early data; client should retry.

Client should upgrade protocol (e.g. HTTP/2).

Server requires an If-Match. Prevents lost updates in optimistic-locking flows.

Rate limit exceeded. SHOULD include Retry-After header.

Headers collectively too large (usually a cookie explosion).

Resource blocked for legal reasons (DMCA, GDPR takedown, government order). Named after Fahrenheit 451.