API & Web ArchitectureUpdated: 2026-11-04

Complete HTTP Status Codes, REST API Errors & Header Reference

Quick lookup guide for all 1xx, 2xx, 3xx, 4xx, and 5xx HTTP response codes with caching directives and RFC definitions.

HTTP response status codes indicate whether a specific HTTP request has been successfully completed. Grouped into five distinct classes, understanding these codes is fundamental for API design, debugging client-side fetch requests, and configuring reverse proxies like Cloudflare or Nginx.

2xx Success Status Codes 3xx Redirection Status Codes 4xx Client Error Status Codes 5xx Server Error Status Codes Essential HTTP Caching Headers

2xx Success Status Codes

Indicates that the client request was received, understood, and accepted by the server.

Code	Name	RFC Specification & Practical Usage
200 OK	Standard Success	Request succeeded. Standard response for GET and successful PUT requests returning payload.
201 Created	Resource Created	Request succeeded and a new resource was created. Typical response for POST requests.
202 Accepted	Asynchronous Processing	Request accepted for processing, but processing has not completed (e.g. background job queue).
204 No Content	Success with No Body	Server successfully processed request but returns no response body (common in DELETE and OPTIONS preflight).

3xx Redirection Status Codes

Indicates that the client must take additional action to complete the request.

Code	Name	SEO & Caching Impact
301 Moved Permanently	Permanent Redirect	Transfers link equity (PageRank) to the target URL. Aggressively cached by browsers.
302 Found	Temporary Redirect	Temporary location change. Does not pass permanent link equity; clients maintain original URL.
304 Not Modified	Conditional Cache Hit	Tells the client that cached response is fresh (matching ETag or If-Modified-Since). Body is empty.
307 Temporary Redirect	Strict Temporary Redirect	Guarantees the HTTP method (e.g. POST) is not transformed into a GET when redirecting.
308 Permanent Redirect	Strict Permanent Redirect	Permanent redirect that preserves the original HTTP request method and body.

4xx Client Error Status Codes

Indicates that the request contains bad syntax or cannot be fulfilled due to client fault.

Code	Name	Cause & Best Practice Handling
400 Bad Request	Malformed Syntax	Invalid JSON body, missing required parameters, or invalid header formatting.
401 Unauthorized	Authentication Required	Request lacks valid authentication credentials (e.g., missing or expired JWT Bearer token).
403 Forbidden	Permission Denied	User is authenticated but lacks required role or scope to access the specified resource.
404 Not Found	Resource Missing	Server cannot find the requested URI. Most common error for dead links and missing assets.
409 Conflict	State Collision	Request conflicts with current server state (e.g. duplicate email during registration or git merge conflict).
422 Unprocessable Entity	Semantic Validation Error	Syntax is valid JSON, but semantic instructions fail validation (e.g. age must be positive number).
429 Too Many Requests	Rate Limit Exceeded	Client sent too many requests in given timeframe. Usually paired with `Retry-After` header.

5xx Server Error Status Codes

Indicates that the server failed to fulfill an apparently valid request.

Code	Name	Infrastructure Meaning
500 Internal Server Error	Generic Unhandled Exception	Server encountered an unexpected condition that prevented it from fulfilling the request.
502 Bad Gateway	Upstream Proxy Failure	Edge reverse proxy (e.g. Nginx, Cloudflare) received an invalid response from upstream origin.
503 Service Unavailable	Server Overload or Maintenance	Server is currently unable to handle the request due to maintenance or sudden traffic surge.
504 Gateway Timeout	Upstream Timeout	Reverse proxy did not receive timely response from origin application server.

Essential HTTP Caching Headers

Key headers that govern browser and CDN caching policies.

Modern Immutable Static Asset Cache (1 Year)http

Cache-Control: public, max-age=31536000, immutable

Ideal for hashed assets (e.g. Next.js chunks, fonts, images) that never mutate.

No-Cache Directive (Validate with ETag on Every Request)http

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0

Forces client to fetch fresh data for sensitive account views and transactional APIs.

Stale-While-Revalidate (Instant Speed + Background Freshness)http

Cache-Control: public, max-age=60, s-maxage=600, stale-while-revalidate=86400

Serves stale cached page instantly while edge CDN revalidates origin in background.

Interactive Client-Side Tools for this Guide

Test and run these patterns directly inside your browser with zero server uploads:

JSON Formatter & Validator (Beautify & Minify)

Clean up messy API responses, fix syntax glitches, and compress JSON payloads directly in your browser.

Open Tool

Private Online JWT Debugger & Token Inspector

Safely inspect and decode JSON Web Tokens with zero cloud transmission. Verify expiration countdowns, claims, and HMAC signatures in complete privacy.

Open Tool

Frequently Asked Questions

What is the exact difference between 401 Unauthorized and 403 Forbidden?

401 Unauthorized means "You are not logged in; please authenticate yourself with credentials or a token." 403 Forbidden means "We know who you are, but you do not have permission to perform this action."

How does 304 Not Modified improve site speed?

A 304 response sends an empty HTTP body. The browser compares its local ETag or Last-Modified header with the server. If identical, the browser renders directly from local memory without re-downloading bytes.

Back to All Cheat Sheets