HTTP Status Codes Every Developer Should Know

HTTP status codes are the first thing you check when something goes wrong with a web request. They’re three-digit numbers that tell you what happened — success, redirect, error, or server failure. Every developer should know the most important ones cold.

2xx — Success

200 OK           — The standard success response. Request worked, here's the data.
201 Created      — A new resource was created (use this for successful POST requests).
204 No Content   — Success, but nothing to return (common for DELETE requests).

When building an API, return 201 when a resource is created, not just 200. It’s a meaningful distinction.

3xx — Redirects

301 Moved Permanently  — The resource has a new permanent URL. Browsers and search
                         engines update their links.
302 Found              — Temporary redirect. Search engines keep the original URL.
304 Not Modified       — Browser's cached version is still valid. No data sent.

4xx — Client Errors

These mean the client (the browser or API caller) did something wrong:

400 Bad Request     — Invalid data sent. Missing required field, wrong format, etc.
401 Unauthorized    — Authentication required. Not logged in.
403 Forbidden       — Authenticated but not allowed. You're logged in but don't have permission.
404 Not Found       — Resource doesn't exist.
409 Conflict        — Request conflicts with current state (e.g., duplicate email).
422 Unprocessable   — Validation failed on the submitted data.
429 Too Many Requests — Rate limit exceeded.

The 401 vs 403 distinction trips everyone up: 401 = “who are you?”, 403 = “I know who you are, but no.”

5xx — Server Errors

These mean something went wrong on the server’s side:

500 Internal Server Error — Generic server crash. Check your logs.
502 Bad Gateway           — Upstream server sent an invalid response.
503 Service Unavailable   — Server is down or overloaded.
504 Gateway Timeout       — Upstream server didn't respond in time.

Using Status Codes in Your Own API

# Flask example
@app.route("/users", methods=["POST"])
def create_user():
    data = request.get_json()
    if not data.get("email"):
        return jsonify({"error": "Email is required"}), 400  # Bad Request
    
    if user_exists(data["email"]):
        return jsonify({"error": "Email already registered"}), 409  # Conflict
    
    user = save_user(data)
    return jsonify(user), 201  # Created

Conclusion

HTTP status codes are the vocabulary of web communication. Use them correctly in your APIs and they become self-documenting — any developer can understand what happened without reading error messages. When debugging, the status code is always your first clue.

Read next: How HTTP Works: The Request-Response Cycle

External resource: MDN — HTTP Response Status Codes