HTTP Status Codes Cheat Sheet for Developers and Testers

Every web request ends with a three-digit number that says whether it worked. This HTTP status codes cheat sheet collects the codes you will meet most often when building or testing web apps and APIs.

Developers use status codes to tell clients what happened. Testers use them to check that the system behaves correctly in both good and bad situations. A clear grasp of HTTP status codes saves hours of debugging, especially when you test APIs.

The definitions follow the HTTP standard in RFC 9110, and the MDN status code reference is a handy companion. If APIs are new to you, start with our guide on what is an API.

The five classes of HTTP status codes

HTTP status codes cheat sheet: 2xx success

HTTP status codes cheat sheet: 3xx redirection codes

HTTP status codes cheat sheet: 4xx client error codes

401 vs 403 vs 404

These three cause the most confusion. A 401 means the server does not know who you are. A 403 means it knows you but you lack permission. A 404 means the thing does not exist, although some APIs return 404 instead of 403 to avoid revealing that a private resource exists.

HTTP status codes cheat sheet: 5xx server error codes

How to test HTTP status codes

For each endpoint, write at least one test for the happy path and for each expected error. Here is a short Python example with the requests library:

import requests

BASE = "https://api.example.com"

def test_create_user_returns_201():
    r = requests.post(f"{BASE}/users", json={"name": "Asha", "email": "asha@example.com"})
    assert r.status_code == 201
    assert "id" in r.json()

def test_missing_token_returns_401():
    r = requests.get(f"{BASE}/me")
    assert r.status_code == 401

def test_unknown_user_returns_404():
    r = requests.get(f"{BASE}/users/999999", headers={"Authorization": "Bearer TOKEN"})
    assert r.status_code == 404

Use this checklist when you review an API:

• Successful create returns 201, not 200.
• Delete returns 204 or 200 consistently.
• Validation failures return 400 or 422 with helpful messages.
• Missing or expired tokens return 401; missing permissions return 403.
• Unknown IDs return 404, not 500.
• Rate limiting returns 429 with a Retry-After header.
• Server failures return 5xx without leaking internal details.

Our API testing with Postman guide shows how to automate these checks in a collection, and our REST API best practices article explains how to pick the right code when designing endpoints.

Final thoughts

Keep this HTTP status codes cheat sheet bookmarked. Learn the five classes first, then the ten or so codes you meet daily: 200, 201, 204, 301, 400, 401, 403, 404, 429 and 500. Use the most accurate code in your API and verify every expected error in your tests.

Frequently asked questions

Keep learning