HTTP Status Code Reference
Search by code, name or meaning. Filter to a class with one keystroke.
—
Worked example
The distinction that matters most in practice: 401 means "I do not know who you are", 403 means "I know who you are and no". Returning 401 for a permission failure sends the client into a pointless re-authentication loop.
Status codes are a contract between server and client. Using the wrong one does not break the request, it breaks everything downstream — retry logic, caching, monitoring dashboards and the browser itself.
The ones people get wrong
302 versus 307: the difference is whether the method survives. 301 versus 308: same, but permanent. 401 versus 403: authentication versus authorisation. 200 with an error in the body: never, because every proxy and client between here and there believes the request succeeded.