You make an API call.
It fails.
You see: 500 Internal Server Error and suddenly you start panicking.
HTTP status codes are the first clue to debugging any API issue.
But most of us either remember a couple of common ones… or end up Googling the rest every time.
This guide is meant to fix that.
(Quick note: WebDAV is an extension of HTTP that lets you manage files over the web. Google Drive or SharePoint use this under the hood. It introduced its own status codes for batch operations and file locks, which is why it pops up a few times here.)
You don’t need to memorize everything here.
Jump to the section based on the status code you’re seeing.
WHAT ARE HTTP STATUS CODES?
HTTP status codes are standardized responses sent by a server to indicate the result of a client’s request.
Every response falls into one of five categories:
1xx → Informational
2xx → Success
3xx → Redirection
4xx → Client Errors
5xx → Server Errors
Think of them as a conversation between frontend and backend
🔵 1xx - “Hey, I got your request… hang on”
“The server received your request and is letting you know what's happening next."
Key Codes:
100 Continue → “Everything looks fine so far. Go ahead and send the rest of your request.”
101 Switching Protocols → “Let’s switch to a different protocol.”
(Example: upgrading from HTTP to WebSockets.)102 Processing (WebDAV) → “I’m still processing your request”
(No final status available yet.)103 Early Hints → “While I prepare the full response, you can already start loading some resources.”
(Helps improve performance by preloading things like CSS or fonts.)
🟢 2xx - “Everything went well”
“Your request was valid… and I handled it successfully.”
Key Codes:
200 OK → “The classic. You asked, the server delivered.”
(Used for successful GET, PUT, PATCH, etc.)201 Created → “I created something new for you.”
(Usually after a successful POST or PUT.)202 Accepted → “I got your request… but I’ll process it later.”
(Used in async operations like background jobs, email queues, anything that runs later.)204 No Content → “Success, but there’s nothing to return.”
(Common for delete/update operations)206 Partial Content → “Only part of the data came back.”
(This is how video streaming and large file downloads work, the client asks for a range, the server delivers it.)
Lesser used:
203 Non Authoritative Information → “Here’s the data, but it might be modified or from another source.”
205 Reset Content → “Success, now reset your UI/form.”
207 Multi-Status (WebDAV) → “Multiple things happened, each with its own status.”
208 Already Reported → “I’ve already included this info earlier, no need to repeat it.”
226 IM Used → “I’m returning a modified version of the resource.”
(Used for delta/partial updates)
🟡 3xx - “Not here… go there”
“What you’re looking for isn’t here… try this instead.”
The server is guiding the client to another URL.
Key Codes:
301 Moved Permanently → “This resource has permanently moved to a new URL.”
(Update your bookmarks with the new URL.)302 Found → “Temporarily moved. Use this other URL for now.”
(But keep using the original URL in future requests)303 See Other → “Go to this new URL using a GET request.”
(Common after form submissions — redirect to a success page)304 Not Modified → “Nothing has changed. Use your cached version.”
(Saves bandwidth and improves performance)307 Temporary Redirect → “Like 302, but your HTTP method stays the same.”
(POST stays POST — nothing changes except the URL)308 Permanent Redirect → “Like 301, but your HTTP method stays the same.”
(POST stays POST — nothing changes except the URL)
Lesser used:
300 Multiple Choices → “There are multiple possible responses, hence pick one.”
305 Use Proxy (Deprecated) → “You must access this via a proxy.”
306 (Unused) → Reserved, but not used anymore.
🔴 4xx - “You messed up”
“I understood your request… but something about it is wrong.”
This is where most real-world bugs live.
Key Codes:
400 Bad Request → “Something about your request is invalid.”
(Bad JSON, missing fields, wrong format)401 Unauthorized → “You need to authenticate first.”
(No token / expired token)403 Forbidden → “I know who you are… you're just not allowed to do this.”
(Check permissions, not credentials.)404 Not Found → “This doesn’t exist.”
(Wrong endpoint or missing resource)405 Method Not Allowed → “The endpoint exists, but not for this method.”
(Example: using POST instead of GET)408 Request Timeout → “You took too long to finish sending the request.”
409 Conflict → “This request clashes with existing data.”
(Duplicate entries, version conflicts)410 Gone → “Like 404, but permanent and intentional.”
(The resource existed, was removed, and won't come back.)413 Content Too Large → “Your request is too big.”
(File upload limits)415 Unsupported Media Type → “Wrong format.”
(Sending XML when JSON is expected. Check yourContent-Typeheader.)422 Unprocessable Content → “Your request is valid… but the data doesn’t make sense.”
(Validation errors — wrong field types, missing required values, business logic failures.)429 Too Many Requests → “Slow down, you’re hitting the API too often.”
Lesser used:
402 Payment Required → “Payment Required. Reserved for payment flows, rarely used.”
406 Not Acceptable → “You asked for a format I can’t give.”
(Like asking for XML when I only speak JSON)407 Proxy Authentication Required → “You need to authenticate… but through a proxy first.”
411 Length Required → “Tell me how big your request is.”
(MissingContent-Lengthheader)412 Precondition Failed → “Your conditional headers don't match reality.”
414 URI Too Long → “That URL is way too long for me to handle.”
416 Range Not Satisfiable → “You asked for a part of data… but it doesn’t exist.”
(Invalid range in file/video requests)417 Expectation Failed → “You expected something… I can’t fulfill that.”
418 I’m a teapot → “I refuse. And also… I’m a teapot.”
(Yes, it's real. An April Fools' RFC from 1998 that somehow stuck around)421 Misdirected Request → “This request came to the wrong server.”
423 Locked / 424 Failed Dependency (WebDAV) → “This resource is locked… or something else failed before this.”
425 Too Early → “I don’t want to process this yet, it might be risky.”
426 Upgrade Required → “I can handle this… but only if you upgrade your protocol.”
(Example: switch to HTTPS)428 Precondition Required → “You need to send conditions to avoid conflicts.”
431 Request Header Fields Too Large → “Your headers are too big.”
451 Unavailable for Legal Reasons → “I can’t give you this… legally.”
(Blocked by government or regulations)
🟠 5xx - “I messed up”
“Your request was fine… but something broke on my server's side.”
Key Codes:
500 Internal Server Error → “Something went wrong… I don’t even know what exactly.”
(Backend crashed, exception thrown, etc. Check your logs.)501 Not Implemented → “I don’t support this functionality.”
(Feature or method not implemented yet.)502 Bad Gateway → “I tried to talk to another service… it gave me a bad response.”
(Microservices / API gateway issues.)503 Service Unavailable → “I’m overloaded or down right now.”
(Server busy, maintenance mode.)504 Gateway Timeout → “I waited for another service… it didn’t respond in time.”
Lesser used:
505 HTTP Version Not Supported → “I don’t support the HTTP version you’re using.”
506 Variant Also Negotiates → “Something’s misconfigured… I ended up in a loop while deciding the response.”
507 Insufficient Storage → “I don’t have enough space to complete this request.”
508 Loop Detected → “I got stuck in an infinite loop while processing this.”
510 Not Extended → “You’re asking for something extra… but I don’t support that extension.”
511 Network Authentication Required → “You need to authenticate to access this network.”
How to Use This While Debugging
When an API fails, start with the status code.
4xx → Check your request (body, headers, params)
5xx → Check backend logs or services
2xx but wrong → Check your logic
Start here before changing random code.
— AbhignaConsole Diaries — a developer’s notes
Connect with me on LinkedIn: a6h1gna
