HTTP Status Codes

HTTP status codes are standardized numeric responses that an HTTP server includes in every reply to indicate whether a request succeeded, requires further action, or encountered an error. The first digit defines the response class, and the remaining two digits specify the exact condition.

How it works

When a server processes a request, it selects the most appropriate status code to describe the outcome: 200 for a successful GET, 201 for a created resource, 400 for a malformed request, 401 for missing authentication, 403 for insufficient permissions, 404 for a missing resource, and 500 for an unhandled server error.

Key facts

• 2xx Success: 200 OK, 201 Created, 204 No Content indicate successful operations
• 4xx Client errors: 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests
• 5xx Server errors: 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable

For builders

Returning semantically correct status codes is essential for API consumers to handle errors gracefully. Using 200 for all responses, including errors, forces clients to parse bodies rather than relying on standard HTTP semantics.

Sources

• IETF. RFC 9110: HTTP Semantics. datatracker.ietf.org
• IETF. RFC 9112: HTTP/1.1. datatracker.ietf.org
• Fielding, R. (2000). Architectural Styles and the Design of Network-based Software Architectures (REST). UC Irvine. ics.uci.edu
• OWASP. API Security Top 10 (2023). owasp.org
• MDN Web Docs. HTTP reference. developer.mozilla.org