HTTP status codes

Keep sending the body. You will rarely see it — clients handle it internally.

The WebSocket upgrade handshake succeeded.

It worked. The body is the answer.

It worked and something now exists. Return where in a Location header.

Queued for later. Nothing is done yet — pair it with a way to check progress.

It worked and there is deliberately no body. DELETEs often end here.

A range request: this is a slice of the file. Video seeking lives on it.

Gone for good, go here instead. Browsers and crawlers cache it hard — a wrong 301 is painful to claw back.

Temporary redirect that historically lets clients change POST to GET. When in doubt you probably want 303 or 307.

Result is elsewhere; fetch it with GET. The right answer after a form POST.

Your cached copy is still good. The reward for sending If-None-Match.

Like 302 but the method must not change — a POST stays a POST.

Like 301 but the method must not change.

The request itself is malformed. If it parsed but fails your rules, 422 is often more precise.

Misnamed: it means UNAUTHENTICATED — we do not know who you are. Sign in and retry.

Reserved for decades, now used honestly by billed APIs: you are out of credit.

We know who you are, and the answer is no. Authenticating harder will not help.

No such thing — or you are not allowed to know whether there is; returning 404 for both avoids leaking existence.

The path exists but not with that verb. Send Allow: with the ones that work.

The client took too long to send. Compare 504, where a server upstream took too long to answer.

The request fights the current state — a duplicate slug, a stale version. Retrying unchanged will not fix it.

Existed, deliberately removed, not coming back. A more honest 404 for retired resources.

Your If-Match no longer matches — someone changed it first. Optimistic locking speaks in this code.

The body is over the limit. Say what the limit is in the response.

Wrong Content-Type — often JSON sent without the header.

An April Fools RFC. Never send it from anything you bill for.

Parsed fine, fails validation. The usual home of field-by-field error responses.

Rate limited. Send Retry-After, and clients: honour it with backoff.

The server broke. If you write it by hand, something more specific is usually truer.

The server does not know that verb at all. Rare in practice.

A proxy reached the backend and got garbage — often a crashed or restarting app behind nginx or Caddy.

Temporarily down or overloaded — deploys, maintenance, circuit breakers. Retry-After is polite.

A proxy waited for the backend and gave up. The request may STILL have executed — never assume it did not.