The Five HTTP Status Code Families

Family Meaning Who Is Responsible?
1xx Informational —
2xx Success —
3xx Redirection —
4xx Client Error The client (caller)
5xx Server Error The server

2xx — Success

Status Code Name Typical Usage
200 OK Successful GET request or successful PUT request
201 Created Successful POST request that creates a new resource
204 No Content Successful request with no response body, commonly returned by PATCH and DELETE

3xx — Redirection

Status Code Name Meaning
301 Moved Permanently The resource has permanently moved to another URL
302 Found Temporary redirect
304 Not Modified Cached resource is still valid

4xx — Client Errors ⭐

These are the status codes API testers validate most frequently during negative testing.

Status Code Name Typical Usage
400 Bad Request Invalid request body, missing mandatory fields, or incorrect data type
401 Unauthorized Missing, invalid, or expired authentication credentials
403 Forbidden Authentication succeeded, but the user lacks permission
404 Not Found Requested resource does not exist
405 Method Not Allowed Unsupported HTTP method for the endpoint
409 Conflict Duplicate resource or resource state conflict
422 Unprocessable Entity Request format is valid, but business validation fails
429 Too Many Requests API rate limit exceeded

5xx — Server Errors

Status Code Name Meaning
500 Internal Server Error Generic server-side failure
502 Bad Gateway Upstream server returned an invalid response
503 Service Unavailable Server is temporarily unavailable or overloaded
504 Gateway Timeout Upstream server failed to respond within the timeout period

Common Interview Questions ⭐

What is the difference between 401 Unauthorized and 403 Forbidden?

  • 401 Unauthorized – Authentication is missing, invalid, or expired.

  • 403 Forbidden – Authentication is valid, but the user does not have permission to perform the requested operation.

    Advertisement

What is the difference between 500 Internal Server Error and 503 Service Unavailable?

  • 500 Internal Server Error – A generic server-side failure or application error.

  • 503 Service Unavailable – The server is temporarily unavailable due to maintenance or heavy load.

What is the difference between 201 Created and 204 No Content?

  • 201 Created – A new resource has been successfully created.

  • 204 No Content – The request completed successfully, but no response body is returned.

HTTP Method → Expected Status Code

API Operation Expected Status Code
GET Resource 200
GET Deleted or Missing Resource 404
POST Create Resource 201
POST Duplicate Resource 409
PUT Full Update 200
PATCH Partial Update 204
DELETE Resource 204 (or 200 depending on the API design)
Missing or Invalid Token 401
Insufficient Permissions 403
Unsupported HTTP Method 405
Invalid Request Payload 400
Internal Server Failure 500

Go Deeper

Continue learning with: