HTTP Status Codes Explained: 200, 301, 404, 500 and More

The five HTTP status code classes

• 1xx Informational: the request is continuing or the protocol is changing state.
• 2xx Successful: the server received and handled the request.
• 3xx Redirection: the client needs another action or may use a cached representation.
• 4xx Client Error: the request cannot be fulfilled as sent or lacks suitable authorization.
• 5xx Server Error: the server failed while handling an apparently valid request.

Common 2xx success codes

200 OK indicates success, with meaning that depends on the request method. 201 Created usually follows creation of a resource and should identify the new resource where applicable. 202 Accepted means processing has been accepted but may not be complete. 204 No Content signals success without a response body.

Common 3xx redirect and cache codes

301 Moved Permanently and 308 Permanent Redirect indicate a lasting URL change. 302 Found and 307 Temporary Redirect are temporary. The 307 and 308 definitions preserve the request method, while historical client behavior around 301 and 302 is a reason to choose redirects deliberately. 304 Not Modified supports conditional caching and is not a normal redirect page.

Common 4xx client errors

400 Bad Request indicates malformed or invalid request syntax. 401 Unauthorized is used when authentication credentials are missing or unacceptable; despite the label, it is about authentication. 403 Forbidden means the server understood the request but refuses it. 404 Not Found means the origin did not find a current representation or is unwilling to disclose one. 429 Too Many Requests signals rate limiting.

Common 5xx server errors

500 Internal Server Error is a general unexpected server failure. 502 Bad Gateway means a gateway received an invalid response from an upstream server. 503 Service Unavailable indicates temporary overload or maintenance and may include Retry-After. 504 Gateway Timeout means a gateway did not receive a timely upstream response.

How to debug a status code

1. Record the exact method, URL, time, and environment.
2. Inspect response headers and the response body.
3. Check redirects as a chain, not one code in isolation.
4. Compare browser, command-line, and server-log evidence.
5. Verify authentication, content type, and request payload.
6. For 5xx errors, trace proxy, application, and dependency logs with a request ID.

The HTTP Status Lookup explains a code; it does not make a live request to a website.

Frequently asked questions

Is every 2xx response successful for the user?

It means the HTTP request succeeded according to the server's response semantics. The returned application data can still describe a business failure, partial result, or validation problem, so inspect the body and API contract.

What is the difference between 401 and 403?

401 is used when acceptable authentication credentials are absent or invalid and normally includes an authentication challenge. 403 means the server understood the request but refuses to fulfill it, even if identity is known.

Should an API return 200 for every response?

Usually no. Meaningful status codes help clients, caches, monitoring, and operators respond correctly. The response body should add application detail without contradicting the HTTP status.