HTTP Status Code Lookup — Reference List

Introduction

HTTP status codes compress request outcomes into three digits — yet teams still debate whether a validation failure should be 400 or 422, whether 401 or 403 fits an expired token, and why the load balancer returns 502 while the app logs show 500. RFC 9110 defines a large taxonomy; daily development relies on a smaller subset repeated in every REST API, CDN, and reverse proxy.

Certoflow's HTTP Status Code Lookup provides a searchable reference of commonly encountered codes: success (200, 201, 204), redirects (301, 302, 304), client errors (400, 401, 403, 404, 409, 422, 429), and server errors (500, 502, 503). Filter by number or keyword — type forbidden to find 403, or 5 to narrow server errors. No network calls; the list is embedded locally. Use with CORS Header Generator when preflight issues masquerade as opaque failures, and JSON Formatter when error bodies accompany status lines.

What this tool does

Feature	Behavior
Search	Filters by code substring or case-insensitive text match
List	Code (monospace) plus human-readable reason phrase
Coverage	Curated subset — not exhaustive IANA registry

Included codes:

Code	Text
200	OK
201	Created
204	No Content
301	Moved Permanently
302	Found
304	Not Modified
400	Bad Request
401	Unauthorized
403	Forbidden
404	Not Found
409	Conflict
422	Unprocessable Entity
429	Too Many Requests
500	Internal Server Error
502	Bad Gateway
503	Service Unavailable

How it works

Codes ship as a static array HTTP_STATUS_CODES. Filtering applies client-side:

HTTP_STATUS_CODES.filter(
  (s) => !query || String(s.code).includes(query) || s.text.toLowerCase().includes(query.toLowerCase()),
);

Empty search shows all entries. Partial code matches work — 40 shows 400, 401, 403, 404, 409. No definitions, RFC links, or retry guidance — phrase labels only.

Real-world examples

API error handler design

Choosing between 400 and 422 for schema validation failures. Lookup both labels, document team convention in OpenAPI, return consistent JSON error bodies formatted with JSON Formatter.

Incident response triage

Users report "site down." 502 suggests upstream gateway failure; 503 often means intentional maintenance or overload. Distinguish from client-side 404 on wrong API path built with Query String Builder.

Teaching REST workshops

Students map CRUD operations to status codes: POST success 201, DELETE success 204, conflict 409. Search interactively during lecture.

Rate limiting implementation

Returning 429 Too Many Requests with Retry-After header — confirm phrase spelling for logs and monitoring dashboards.

CDN cache debugging

304 Not Modified versus 200 OK drives cache hit metrics. Lookup clarifies semantics when comparing If-None-Match behavior.

Common mistakes

Treating 401 and 403 as interchangeable. 401 means authentication required or failed; 403 means authenticated but not authorized. APIs confuse them constantly.

Returning 200 with error JSON bodies. Some legacy APIs do this — the lookup reminds you standard REST prefers 4xx/5xx codes.

Using 404 to hide existence of resources. Security through obscurity debates aside, choose 403 when policy requires differentiation.

Ignoring 502 versus 503 operations playbooks. 502 often needs upstream health checks; 503 may trigger circuit breakers and user-facing maintenance pages.

Expecting complete IANA list. Obscure codes like 418 or WebDAV extensions are not included — consult full references for edge protocols.

Searching only exact codes. Text search helps when you remember "Conflict" but not 409.

Use cases

Backend developers picking appropriate response codes during endpoint design.

Frontend engineers mapping fetch response.status to user messaging.

SRE staff correlating load balancer codes with application logs.

Technical interviewers quick reference during system design discussions.

Students memorizing common codes beyond 200 and 404.

Technical writers consistent status naming in API documentation.

FAQ

Is the list complete?

No. It covers frequently used REST and web codes, not every registered status.

Does search require exact code match?

Substring match — 04 matches 404, 409, etc.

Are definitions included?

Reason phrases only, per HTTP convention (e.g., "Not Found").

Is data fetched from the internet?

No. The reference is embedded and works offline after load.

Why include 422?

Common in Rails and JSON API validation ecosystems for semantic errors.

What is 204 used for?

Successful response with no body — typical DELETE success.

How does 301 differ from 302?

301 Moved Permanently signals permanent URL change; 302 Found is temporary redirect.

Related debugging tools?

CORS Header Generator, JWT Decoder for auth-related 401s.

Can I search case-insensitively?

Yes, for text fields. Code search is numeric substring.

Does Certoflow store searches?

No. Filtering is entirely local.