Web
HTTP status codes
The first digit tells you the category: 2xx succeeded, 3xx moved, 4xx the client got it wrong, 5xx the server did. Most debugging time is spent working out whether a 403 is your fault or theirs.
How to use it
- Filter by number or by keyword such as “redirect”.
- Read the explanation for the code you met.
- Check the category column to see who is at fault.
- For API work, 401 versus 403 is the distinction that matters most.
Status codes drive caching and indexing
A 301 tells a crawler to transfer ranking signals and stop requesting the old URL. A 302 keeps both URLs alive. A 304 lets a browser reuse its cached copy and skip the body transfer entirely. Getting these wrong is not cosmetic: a temporary redirect used for a permanent move leaks ranking for as long as it stays in place, and a 200 that serves an error page gets that error page indexed.
Choosing between 400, 401, 403 and 422
400 means the request is malformed. 401 means authentication is missing or failed. 403 means authentication succeeded and authorisation did not. 422 means the syntax is valid but the values are semantically wrong — a date in the past, an age of 200. Collapsing all four into 400 is common practice and turns every client-side error handler into guesswork.
Debugging an API by status code alone
401 means "I do not know who you are"; 403 means "I know, and you may not". Getting them backwards sends clients into a re-authentication loop that can never succeed. 429 should come with a Retry-After header — without it, clients retry immediately and make the overload worse.
On the gateway side, 502 is "the upstream returned something unusable", 503 is "not accepting traffic right now", 504 is "upstream did not answer in time". Those three point at different systems: a bad deploy, a deliberate drain, and a slow query respectively. Reading the code before opening the logs usually halves the search.
Frequently asked questions
What is the difference between 401 and 403?
401 means the server does not know who you are — you failed to authenticate, or your token expired. 403 means it knows and refuses — your role lacks permission. Retrying a 403 with the same credentials is pointless.
When should I use 301 rather than 302?
301 when the move is permanent and you want ranking signals transferred. 302 when it is temporary, such as a redirect during a deploy. Getting this wrong on a site migration costs real traffic.
Why does a 200 page sometimes show an error message?
Some APIs return 200 with an error body, which is a design mistake — clients and caches both treat it as success. Well-behaved services use 4xx for client errors.
Is 418 real?
It started as an RFC joke in 1998 and survived into later specifications. Some servers and frameworks genuinely return it, and it is a favourite for easter eggs.
Is 301 or 302 better for a permanent move?
301. It passes ranking signals and browsers cache it; 302 is for temporary routing and should not be cached long.
Should an API return 200 with an error body?
No. Clients and monitoring both key off the status code; a 200 carrying an error hides failures until someone reads the logs.