HTTP Status Code Reference
Interactive HTTP status code reference. Search by code or description, filter by category (1xx–5xx), get meaning, common causes, and ready-to-use assertion snippets for Playwright, RestAssured, and pytest.
Server received headers, client should send body.
- •Large file uploads
- •Expect: 100-continue header
Rarely asserted directly. Check if client proceeds with body.Server switching to protocol requested via Upgrade header.
- •WebSocket upgrade
Assert 101 when testing WebSocket connections.Server received and is processing, but no response yet.
- •Long-running WebDAV operations
Used in WebDAV. Rarely tested in REST APIs.Request succeeded. Standard response for successful requests.
- •GET/PUT/PATCH successful
expect(response.status).toBe(200)Request succeeded and a new resource was created.
- •POST creating a resource
Assert 201 on POST. Check Location header for new resource URL.Request accepted for processing, but not completed yet.
- •Async job queued
- •Webhook accepted
Assert 202 for async operations. Poll for completion.Response was modified by a proxy or transforming intermediary.
- •Transforming proxy in the path
- •Content optimisation gateway
Rarely asserted. If you see it in tests, a proxy is rewriting your payload.Request succeeded, but no response body.
- •DELETE successful
- •PUT with no return body
Assert 204 on DELETE. Verify body is empty.Request succeeded; the client should reset its document view.
- •Form submission that clears the form
Assert the body is empty. Almost never used in REST APIs.Server returning partial resource due to Range header.
- •Video streaming
- •Large file download resume
Assert Content-Range header is present.More than one representation is available; the client chooses.
- •Content negotiation with no preferred variant
Assert the body lists the alternatives. Rare in practice.Resource permanently moved to new URL.
- •URL restructuring
- •HTTP→HTTPS redirect
Assert Location header. Test that clients follow redirect.Resource temporarily at different URL.
- •Login redirect
- •Temporary maintenance page
Assert Location header. Common after form submissions.Fetch the result of the request from another URI using GET.
- •POST-redirect-GET after a form submission
- •Async job pointing at its result
Assert 303 for POST-redirect-GET. Unlike 307, the follow-up must be a GET.Cached version is still valid. No body returned.
- •Conditional GET with If-None-Match/If-Modified-Since
Assert 304 with ETag/Last-Modified headers in caching tests.Like 302, but method and body must not change.
- •HTTPS redirect preserving POST method
Assert original method is preserved after redirect.Like 301, but method and body must not change.
- •Permanent URL change preserving POST
Assert method preservation. Test with non-GET methods.Server cannot process due to client error (malformed syntax).
- •Invalid JSON body
- •Missing required field
- •Wrong data type
Assert 400 for validation tests. Check error message in body.Authentication required or credentials invalid.
- •Missing auth token
- •Expired JWT
- •Invalid API key
Assert 401 without credentials. Test expired token handling.Reserved for payment-gated access; used by some metered APIs.
- •Subscription lapsed
- •Usage quota needs topping up
Assert 402 in billing and plan-limit tests where the API uses it.Server understood request but refuses to authorize it.
- •Insufficient permissions
- •IP blocked
- •CORS denied
Assert 403 for role-based access control tests.Server cannot find the requested resource.
- •Wrong URL
- •Deleted resource
- •Typo in endpoint
Assert 404 for deleted resources and invalid endpoints.HTTP method not supported for this endpoint.
- •PUT on read-only endpoint
- •DELETE not allowed
Assert 405 when sending wrong HTTP method. Also assert the Allow header.No representation matches the request's Accept headers.
- •Accept: application/xml on a JSON-only endpoint
- •Unsupported Accept-Language
Assert 406 in content-negotiation tests by sending an unsupported Accept.The client must authenticate with the proxy first.
- •Corporate proxy in CI
- •Missing proxy credentials in the runner
Seeing this in CI usually means the runner's proxy config is missing, not an API bug.The server closed an idle connection while waiting for the request.
- •Client sent headers then stalled
- •Keep-alive idle timeout reached
Assert 408 in slow-client tests. Distinguish it from 504, which is an upstream timeout.Request conflicts with current server state.
- •Duplicate entry
- •Concurrent update conflict
Assert 409 for duplicate creation or optimistic locking.The resource existed and has been permanently removed.
- •Deliberately retired endpoint
- •Hard-deleted resource with a tombstone
Assert 410 rather than 404 when a deletion is permanent and you want clients to stop retrying.The server refuses the request without a Content-Length header.
- •Streaming a body without a length
- •Chunked upload to an endpoint that requires a length
Assert 411 when posting a body with no Content-Length.A conditional header did not match the current resource state.
- •If-Match ETag no longer current
- •Lost-update protection triggered
Assert 412 in optimistic-concurrency tests: read an ETag, change the resource, then PUT with the stale If-Match.Request body exceeds server limits. Called "Payload Too Large" before RFC 9110.
- •File upload too large
- •Body size limit reached
Assert 413 with oversized payloads in boundary tests.The request target is longer than the server will accept.
- •Filter or query params serialised into the URL
- •GET used where POST was needed
Assert 414 in boundary tests on endpoints that take long query strings.Content-Type not supported by the endpoint.
- •Sending XML to JSON-only endpoint
- •Missing Content-Type header
Assert 415 with wrong Content-Type header.The requested Range lies outside the resource.
- •Resume offset past end of file
- •Range header on a zero-length resource
Assert 416 in download-resume tests with an out-of-bounds Range.The Expect header cannot be met by the server.
- •Expect: 100-continue through a proxy that will not honour it
Assert 417 when testing large uploads that negotiate with Expect.The request reached a server that cannot serve this authority.
- •HTTP/2 connection coalescing across hosts
- •Wrong SNI / certificate reuse
Usually infrastructure, not the API. Check which host actually terminated the connection.Request well-formed but semantically invalid. Called "Unprocessable Entity" before RFC 9110.
- •Business rule violation
- •Invalid field value
Assert 422 for semantic validation. Popular in REST APIs.The client must switch protocols to continue.
- •Endpoint requires TLS
- •WebSocket-only endpoint hit over plain HTTP
Assert the Upgrade header names the protocol the server expects.The server requires the request to be conditional.
- •PUT without If-Match on an endpoint that forbids blind overwrites
Assert 428 to prove the API refuses unconditional writes. Pairs with 412.Rate limit exceeded.
- •API rate limiting
- •DDoS protection
Assert 429 in rate limit tests. Check Retry-After header.The request's headers are collectively or individually too large.
- •Oversized cookie jar
- •A very long Authorization or trace header
Assert 431 in boundary tests that grow a header until it is rejected.Access denied because of a legal demand.
- •Geo-blocking for regulatory reasons
- •Takedown notice
Assert 451 in geo/compliance tests where the API distinguishes it from 403.Unexpected server error.
- •Unhandled exception
- •Database down
- •Bug in server code
Should NOT appear in happy-path tests. Log and investigate.The server does not support the functionality required.
- •Method recognised but never implemented
- •Feature behind a flag that is off
Assert 501 for endpoints that are declared but not built. Unlike 405, this is about the server, not the route.Server got invalid response from upstream.
- •Upstream service down
- •Proxy misconfiguration
Assert 502 in service mesh / gateway tests.Server temporarily unable to handle requests.
- •Maintenance mode
- •Server overloaded
Assert 503 during maintenance window tests.Server didn't get response from upstream in time.
- •Slow upstream service
- •Network timeout
Assert 504 in timeout and resilience tests.The server refuses the request's HTTP version.
- •Client forced to HTTP/2 against an HTTP/1.1-only origin
Assert this when pinning protocol versions in client compatibility tests.Frequently Asked Questions(click to expand)
What is the difference between 401 and 403?
401 (Unauthorized) means the client has not provided valid authentication credentials. 403 (Forbidden) means the client is authenticated but does not have permission to access the resource.
When should I use 200 vs 201 vs 204?
Use 200 for successful GET/PUT/PATCH requests that return data. Use 201 for POST requests that create a new resource. Use 204 for DELETE or actions that succeed but return no body.