Skip to content

Beginner · How the web and backends work · topic 4 of 54 · 20 min

HTTP status codes

Explanation

Every response starts with a status code, a three-digit number that tells the client what happened. Codes in the 200s mean success, 300s mean "look somewhere else", 400s mean the client made a mistake and 500s mean the server failed. Picking the right code helps apps, browsers and developers react correctly.

Five families

A status code is a three-digit number at the start of every response. The first digit tells you the family, so even an unknown code like 418 can be understood: it starts with 4, so the client did something wrong.

FamilyMeaningExample
1xxInformation: "keep going"100 Continue (rare in daily work)
2xxSuccess200 OK
3xxRedirect: look somewhere else301 Moved Permanently
4xxClient error: the request was wrong404 Not Found
5xxServer error: the server failed500 Internal Server Error
Tip: Easy way to remember: 2xx "you did it", 3xx "go there", 4xx "you messed up", 5xx "we messed up".

Codes you will use every day

CodeNameWhen to use it
200OKNormal success with a body (GET, PATCH)
201CreatedA POST created something new
204No ContentSuccess with no body, often after DELETE
301Moved PermanentlyThe page moved for good (old URL to new URL)
302FoundA short-time redirect, for example to the login page
304Not ModifiedThe copy the browser already has is still fresh
400Bad RequestThe request is broken, like invalid JSON
401UnauthorizedNot logged in: we do not know who you are
403ForbiddenLogged in, but not allowed to do this
404Not FoundThe thing does not exist
405Method Not AllowedThe path exists, but not with this method
409ConflictClashes with current data, like a username already taken
422Unprocessable ContentWell-formed data that breaks a rule, like age -5
429Too Many RequestsSlow down, for example too many OTP requests
500Internal Server ErrorA bug or crash in the server code
502Bad GatewayA server in the middle got a bad answer from the next server
503Service UnavailableThe server is down for maintenance or overloaded

401 or 403?

Think of it like this: Think of an office building. If you come without an ID card, the guard stops you: "Who are you?" That is 401. If your ID card is fine but you try to enter the CEO floor, the guard says "You are not allowed here". That is 403. If you ask for room 999 and the building has no such room, that is 404.
javascript
function family(code) {
  const first = Math.floor(code / 100);
  return first + 'xx';
}

console.log(family(201)); // 2xx
console.log(family(404)); // 4xx
console.log(family(503)); // 5xx
Dividing by 100 and rounding down gives the first digit, which is the family.
Careful: Do not send status 200 with a body like {"error": "not found"}. Apps, browsers and monitoring tools look at the code first. A wrong 200 hides real problems and breaks caching and retries.

Codes 429, 502 and 503 are often temporary. A client can wait a little and try again. A 400 or 404 will fail the same way every time, so retrying does not help.

Watch the lesson

HTTP status codes · 1/6

200 404 500

Every response starts with a three digit status code. It tells the client what happened.

Prefer a video by a teacher? Find free videos on “http status codes explained 200 404 500 for beginners” on YouTube ↗

In real life: An OTP login flow

A user asks for an OTP: the server sends it and answers 200. The user asks again ten times in a minute: the server answers 429 Too Many Requests. The user types a wrong OTP: 401. The user is logged in but opens another user's order: 403. The order number does not exist: 404. The SMS provider is down: the backend answers 503 so the app can show "Please try again in a few minutes".

javascript
const attempts = { '9876543210': 11 };
function requestOtp(mobile) {
  if (attempts[mobile] > 5) return { status: 429, body: 'Too many requests. Try after 10 minutes.' };
  return { status: 200, body: 'OTP sent' };
}
console.log(requestOtp('9876543210')); // status 429
console.log(requestOtp('9123456780')); // status 200
The same endpoint returns different codes for different situations.

Practice (0/3 done)

Task 1 · Code · Javascript

Write a function statusFamily(code) that returns "informational" for 100-199, "success" for 200-299, "redirect" for 300-399, "client error" for 400-499, "server error" for 500-599 and "unknown" for anything else.

Task 2 · Code · Javascript

Write a function chooseStatus(situation) that returns the right code: "ok" 200, "created" 201, "deleted" 204, "bad json" 400, "not logged in" 401, "not allowed" 403, "not found" 404, "already exists" 409, "too many requests" 429. Anything else returns 500.

Task 3 · Code · Javascript

Write a function isRetryable(status) that returns true for codes worth trying again later (429, 502, 503, 504) and false for every other code.

Quick quiz

Question 1

1.A POST request created a new user. Which code fits best?

Question 2

2.A logged-in student tries to open the teacher's marks page. Which code?

Question 3

3.What does a 5xx code mean?

Question 4

4.Someone asks for OTPs 20 times in one minute. Which code should the server send?

Question 5

5.A user signs up with an email that is already registered. Which code fits best?

Read more (free)

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: HTTP headers and cookies →

← Previous: HTTP requests, responses and methods