HTTP Status Codes

The initial part of the request has been received; the client should continue sending the body.

The server agrees to switch protocols as requested via the Upgrade header (for example to WebSocket).

WebDAV: the server has received the request and is still processing it, but no response is available yet.

Preliminary headers (typically Link: rel=preload) sent while the server prepares the final response.

The request succeeded. The meaning of the body depends on the method: GET returns the resource, POST returns the result.

The request succeeded and one or more new resources were created.

The request was accepted for processing, but processing has not completed and may ultimately fail.

The request succeeded, but a transforming proxy modified the payload or headers from the origin response.

The request succeeded and there is no body to return. Headers may still carry updated metadata such as ETag.

Like 204, but the client should reset the document view (for example clear the form that submitted the request).

The server is delivering only part of the resource, in response to a Range request.

WebDAV: the body is an XML document containing a separate status for each affected resource.

WebDAV: the members of a binding have already been enumerated earlier in the same Multi-Status response.

Apache HTTP Server: a catch-all used when ProxyErrorOverride is enabled and the backend returned an error the server chose to pass through as success.

The server fulfilled a GET using instance manipulations (delta encoding) as described by the A-IM request header.

The resource has more than one representation, and the client (or user) should pick one.

The resource has been assigned a new permanent URL. User agents may change POST to GET when following.

The resource is temporarily at a different URL. Most browsers change POST to GET when following.

The client should retrieve a different URL with GET, typically the result of a POST. The method always changes to GET.

A conditional GET or HEAD matched: the cached copy is still valid, so no body is sent.

The resource is temporarily at a different URL. The client must repeat the request with the same method and body.

The resource has permanently moved. The client must repeat the request with the same method and body.

The server cannot or will not process the request because of a client error such as malformed syntax or invalid framing.

The request lacks valid authentication credentials. Despite the name, this means "not authenticated".

Reserved for future use. Some APIs use it to signal an exhausted quota or a required paid plan.

The server understood the request and knows who the client is, but refuses to authorise it. Re-authenticating will not help.

The origin found no current representation for the target resource, or is not willing to disclose that one exists.

The method is known by the server but not supported by the target resource.

The server cannot produce a representation matching the request Accept-* headers.

Like 401, but the client must first authenticate with the proxy identified by Proxy-Authenticate.

The server gave up waiting for the client to finish sending the request.

The request conflicts with the current state of the target resource.

The resource is no longer available at this URL and the condition is expected to be permanent.

The server refuses to accept the request without a Content-Length header.

One or more conditions in If-Match, If-None-Match, or If-Unmodified-Since evaluated to false.

The request body is larger than the server is willing or able to process. Formerly "Payload Too Large".

The request target is longer than the server is willing to interpret.

The request Content-Type (or Content-Encoding) is not supported for the target resource.

None of the ranges in the Range header overlap the current extent of the resource.

The expectation in the Expect request header could not be met by the server.

Defined by the 1998 April Fools RFC 2324 (HTCPCP): the server is a teapot and refuses to brew coffee.

Laravel: the CSRF token is missing or expired, so the form or AJAX request was rejected.

Twitter (v1 API): the client was rate limited. Spring Framework used 420 as "Method Failure".

The request was sent to a server that cannot produce an authoritative response for the target URI (wrong host on a reused connection).

The request is syntactically correct but semantically invalid, so the server cannot process the contained instructions.

WebDAV: the source or destination resource is locked.

WebDAV: the request failed because it depended on another request that failed.

The server is unwilling to risk processing a request that might be replayed (TLS 1.3 0-RTT early data).

The server refuses to perform the request over the current protocol but will after the client upgrades.

The origin requires the request to be conditional (If-Match etc.) to prevent lost updates.

The user has sent too many requests in a given amount of time (rate limiting).

Shopify: returned instead of 429 when too many URLs are requested in a short window (a rate-limit signal despite the name).

The server is unwilling to process the request because a header field, or all of them together, are too large.

nginx: the connection was closed without sending any response. Only visible in nginx logs, never to the client.

Microsoft IIS: the request should be retried after performing the appropriate action (for example supplying more information).

Microsoft: Windows Parental Controls is blocking access to the requested web page.

The server is denying access as a consequence of a legal demand (court order, takedown, sanctions).

AWS ELB: the client closed the connection with the load balancer before the idle timeout elapsed and before the target responded.

AWS ELB: the X-Forwarded-For header contains more than 30 IP addresses.

AWS ELB: the request protocol is incompatible with the target group protocol (for example gRPC to a non-gRPC target).

nginx: a request header or the total header block exceeds large_client_header_buffers.

nginx: the client certificate failed verification (ssl_verify_client on).

nginx: a client certificate was required but none was provided.

nginx: a plain-HTTP request arrived on a port configured for HTTPS.

Esri ArcGIS: the provided token is expired or otherwise invalid.

nginx: the client closed the connection before the server could send a response. Also used by Esri ArcGIS for "token required".

The server encountered an unexpected condition that prevented it from fulfilling the request.

The server does not support the functionality required to fulfil the request, typically an unrecognised method.

The server, acting as a gateway or proxy, received an invalid response from the upstream it contacted.

The server is currently unable to handle the request because of temporary overload or scheduled maintenance.

The server, acting as a gateway or proxy, did not receive a timely response from the upstream.

The server does not support the major HTTP version used in the request.

Transparent content negotiation resulted in a circular reference: the chosen variant is itself a negotiation endpoint.

WebDAV: the server cannot store the representation needed to complete the request.

WebDAV: the server terminated an operation because it encountered an infinite loop while processing a request with Depth: infinity.

Apache (mod_bw / cPanel): the site has exceeded its allotted bandwidth for the period.

The policy for accessing the resource has not been met; further extensions to the request are required.

The client needs to authenticate to gain network access (captive portal).

Cloudflare: the origin returned an empty, unknown, or unexpected response (for example headers exceeding 16 KB or a reset connection).

Cloudflare: the origin actively refused the TCP connection on the configured port.

Cloudflare: the TCP handshake with the origin timed out (no SYN-ACK within ~15 s or no ACK within 90 s after sending the request).

Cloudflare: the origin IP cannot be reached; there is no route to the host.

Cloudflare: the TCP connection succeeded and the request was sent, but the origin did not return an HTTP response within 100 s.

Cloudflare: the TLS handshake with the origin failed (Full or Full (strict) mode).

Cloudflare: in Full (strict) mode the origin certificate is expired, self-signed, or does not match the hostname.

Cloudflare: the connection between Cloudflare and the origin Railgun server was interrupted. Railgun was retired in 2024.

Qualys SSL Labs: the server is overloaded and cannot process the request right now.

Cloudflare: returned together with a 1xxx error (most often 1016 Origin DNS error). Also used by Pantheon for frozen sites.

AWS ELB: the identity provider returned an error while the Application Load Balancer was authenticating the user.

Some HTTP proxies: the proxy timed out reading from the upstream network. Not an IANA-registered code.

Some HTTP proxies: the proxy timed out while connecting to the upstream. Not an IANA-registered code.