HTTP Status Codes

The client should continue with its request.

Sent in reply to an Expect: 100-continue header before the client uploads a large body.

The server is switching protocols as requested by the client.

Use when upgrading a connection, for example to WebSockets via the Upgrade header.

The server has received the request but no response is available yet.

A WebDAV hint that a long operation is still running so the client does not time out.

Returns some response headers before the final response.

Send Link headers early so the browser can preload or preconnect while the server works.

The request succeeded.

The default success response for GET, and for any request whose result is returned in the body.

The request succeeded and a new resource was created.

Return after a POST or PUT that creates a resource, with a Location header pointing to it.

The request was accepted but not yet acted upon.

Use for asynchronous work that will be processed later, such as a queued job.

The headers may differ from what the origin server sent.

A proxy or transforming gateway modified the payload before returning it.

The request succeeded but there is no body to return.

Use for a successful DELETE or a save where the client does not need a response body.

The client should reset the document that sent the request.

Tell a form-based client to clear its inputs after a successful submission.

The server is delivering part of the resource.

Respond to a Range request, for example when resuming a download or streaming media.

Conveys multiple statuses for multiple sub-requests.

A WebDAV response carrying per-resource results inside an XML body.

The members of a binding were already enumerated.

A WebDAV optimisation to avoid repeating the same resource in a multi-status reply.

The response is the result of instance manipulations.

Used with delta encoding where the body represents one or more applied diffs.

The request has more than one possible response.

Offer the client a list of representations to choose from.

The resource has permanently moved to a new URL.

Use for permanent redirects so clients and search engines update their links.

The resource is temporarily at a different URL.

Use for a temporary redirect where the request method may change to GET.

The response is found at another URL with a GET.

Redirect after a POST so a refresh does not resubmit the form (Post-Redirect-Get).

The cached copy is still valid.

Reply to a conditional GET with ETag or If-Modified-Since so the client reuses its cache.

Temporary redirect that preserves the request method.

Like 302 but the client must repeat the request with the same method and body.

Permanent redirect that preserves the request method.

Like 301 but the method and body must not change on the new URL.

The server cannot process the request due to a client error.

Use for malformed syntax, invalid parameters, or a body that fails validation.

Authentication is required and has failed or not been provided.

Return when no valid credentials are present; include a WWW-Authenticate header.

Reserved for future use, often used for billing.

Some APIs use it to signal that payment or an upgraded plan is required.

The client is authenticated but not allowed access.

Use when the user is known but lacks permission for the resource or action.

The server cannot find the requested resource.

Use when the URL does not map to anything, or to hide a resource the user cannot access.

The method is not supported for this resource.

Reject an unsupported verb and list the allowed ones in an Allow header.

No representation matches the Accept headers.

The client asked for a content type the server cannot produce.

Authentication with a proxy is required.

Like 401 but the credentials must be provided to an intermediate proxy.

The server timed out waiting for the request.

The client was too slow to send a complete request; it may retry.

The request conflicts with the current state of the resource.

Use for edit conflicts, duplicate creation, or a failed optimistic-concurrency check.

The resource is permanently gone with no forwarding address.

Stronger than 404 for resources you know are deleted and will not return.

The request needs a Content-Length header.

Reject a request whose body length must be known in advance.

A precondition in the request headers failed.

A conditional request such as If-Match did not hold, often guarding against lost updates.

The request body is larger than the server will accept. Older name: Payload Too Large.

Reject uploads that exceed your size limit.

The request URI is longer than the server will accept.

Often caused by encoding too much data into a GET query string.

The request body is in an unsupported format.

Reject a body whose Content-Type the endpoint does not understand.

The requested range cannot be served.

The Range header asked for bytes outside the resource length.

The server cannot meet the request's Expect header.

The expectation in the Expect header, such as 100-continue, could not be satisfied.

The server refuses to brew coffee because it is a teapot.

A joke status from RFC 2324; occasionally used as a playful refusal.

The request was sent to a server that cannot respond.

The connection was reused for an authority this server does not serve.

The request was well formed but semantically invalid. Older name: Unprocessable Entity.

Use for validation errors where the syntax is fine but the data is not acceptable.

The resource being accessed is locked.

A WebDAV lock prevents the operation.

The request failed because a dependent request failed.

A WebDAV operation depended on another action that did not succeed.

The server is unwilling to risk processing a replayed request.

Reject early data that could be replayed during a TLS handshake.

The client should switch to a different protocol.

Require an upgrade, for example to a newer TLS or HTTP version, via the Upgrade header.

The origin server requires the request to be conditional.

Force clients to use If-Match so concurrent updates do not clobber each other.

The client has sent too many requests in a given time.

Use for rate limiting; include a Retry-After header telling the client when to retry.

The header fields are too large to process.

Reject requests with oversized headers or too many cookies.

The resource is blocked for legal reasons.

Use when content is withheld due to a legal demand such as a takedown.

Non-standard. The client closed the connection before the server sent a response.

An Nginx-specific code logged when a client disconnects mid-request, often a cancelled fetch or a closed tab.

The server hit an unexpected condition.

The catch-all when an unhandled error stops the server from fulfilling the request.

The server does not support the functionality required.

Return when the method or feature is not implemented at all.

An upstream server returned an invalid response.

A gateway or proxy got a broken reply from the server it forwards to.

The server is not ready to handle the request.

Use during maintenance or overload; include Retry-After to suggest when to come back.

An upstream server did not respond in time.

A gateway or proxy timed out waiting for an upstream server.

The HTTP version is not supported.

The server refuses the major HTTP version used in the request.

The chosen variant is itself a negotiation endpoint.

A content-negotiation misconfiguration produced a circular reference.

The server cannot store the representation.

A WebDAV server has run out of space to complete the request.

The server detected an infinite loop.

A WebDAV operation entered an infinite loop while processing.

Further extensions to the request are required.

The server needs an extension declared in the request to proceed.

The client needs to authenticate to gain network access.

Used by captive portals to require sign-in before granting internet access.

Non-standard. Cloudflare got an empty, unknown, or unexpected response from the origin.

A Cloudflare code that usually points to a crash or a dropped connection at your origin server.

Non-standard. Cloudflare could not reach the origin server.

A Cloudflare code meaning the origin refused the connection, often because it is offline or blocking Cloudflare IPs.

Non-standard. The connection between Cloudflare and the origin timed out.

A Cloudflare code seen when the origin is overloaded or a firewall is dropping the connection.

Non-standard. Cloudflare could not find a route to the origin.

A Cloudflare code that usually means a DNS or routing problem pointing at a dead origin address.

Non-standard. Cloudflare reached the origin but did not get a timely reply.

A Cloudflare code for an origin that accepted the connection but took too long to respond.

Non-standard. The TLS handshake between Cloudflare and the origin failed.

A Cloudflare code usually caused by a misconfigured or mismatched SSL certificate at the origin.

Non-standard. The origin presented an SSL certificate that could not be validated.

A Cloudflare code raised in full TLS mode when the origin certificate is expired, self-signed, or untrusted.