Web & APIs
HTTP Status Codes That Matter in Design
Not the full list — the codes with design consequences: 201 + Location for creation, 304 for conditional GETs, 409 for optimistic concurrency, and 429/503 + Retry-After as the backpressure signals that drive client retries.
Updated August 30, 2026 · 4 min read
2xx — success
| 200 OK | Standard success with a body. |
|---|
| 201 Created | Resource created — return a Location header. |
|---|
| 202 Accepted | Accepted for async processing; not done yet. |
|---|
| 204 No Content | Success, empty body (e.g. DELETE). |
|---|
3xx — redirection & caching
| 301 Moved Permanently | Permanent move; clients/SEO update the URL. |
|---|
| 302 / 307 Temporary | Temporary redirect; 307 preserves the method. |
|---|
| 304 Not Modified | Conditional GET hit — client uses its cache.Drives ETag / If-None-Match. |
|---|
4xx — client errors (don’t retry blindly)
| 400 Bad Request | Malformed request. |
|---|
| 401 Unauthorized | Not authenticated (missing/invalid credentials). |
|---|
| 403 Forbidden | Authenticated but not allowed. |
|---|
| 404 Not Found | No such resource (or hidden for privacy). |
|---|
| 409 Conflict | State conflict — optimistic concurrency / version mismatch. |
|---|
| 422 Unprocessable | Well-formed but semantically invalid. |
|---|
| 429 Too Many Requests | Rate limited — send Retry-After.The client backpressure signal. |
|---|
5xx — server errors (retry with backoff)
| 500 Internal Server Error | Unexpected server fault. |
|---|
| 502 Bad Gateway | Upstream returned an invalid response. |
|---|
| 503 Service Unavailable | Overloaded / down — send Retry-After.The “back off” signal. |
|---|
| 504 Gateway Timeout | Upstream didn’t respond in time. |
|---|
In the interview
- →Tie codes to retry policy: 4xx means the client is wrong (don’t retry), 5xx and 429 mean back off and retry — ideally honoring Retry-After.
- →Idempotency decides retry safety: GET/PUT/DELETE are idempotent; POST isn’t, so guard retried POSTs with an idempotency key.
- →429 and 503 + Retry-After are how a server sheds load gracefully. A design that just returns 500 under overload is missing backpressure.