HTTP status codes explained

HTTP status codes are grouped by their first digit. 1xx codes are informational, 2xx codes indicate success, 3xx codes involve redirects or cache behavior, 4xx codes point to client-side issues, and 5xx codes point to server-side or upstream failures.

The family often tells you where to look first. A 400 suggests request input, while a 500 suggests server logs or upstream dependencies.

200 OK means the request succeeded. 201 Created usually follows successful resource creation. 204 No Content means success without a body. 301 and 302 are redirects, while 304 tells the client its cached copy is still valid.

Even success codes need context. A 204 is correct for some deletes but surprising if the client expected JSON.

400 Bad Request often means malformed input. 401 Unauthorized means authentication is missing or invalid. 403 Forbidden means the caller is not allowed. 404 Not Found means the route or resource does not exist. 422 often means validation failed.

Client errors are not always the frontend's fault. Documentation gaps, backend validation changes, and environment mismatch can also create 4xx responses.

500 Internal Server Error is a generic server failure. 502 Bad Gateway and 504 Gateway Timeout often involve proxies or upstream services. 503 Service Unavailable can indicate overload, maintenance, or temporary failure.

When investigating 5xx errors, capture status, headers, request ID, timing, and the response body if safe. Those details help connect client reports to server logs.