4xx Client Error

Every response status code from 1xx to 5xx. See each code's meaning, when it happens, causes, fixes, and examples.

400Bad Request common400 Bad Request is a generic client error meaning the request is malformed and the server cannot process it — broken body syntax, invalid framing, or failed basic validation.401Unauthorized common401 Unauthorized means authentication is required and the request was rejected because credentials are missing or invalid. Despite the name "Unauthorized," it really means "unauthenticated" — the server could not verify who is making the request.402Payment Required402 Payment Required was reserved for future use and has no officially standardized meaning in HTTP. Even so, some APIs and SaaS products use it pragmatically to signal that payment or a credit top-up is needed.403Forbidden common403 Forbidden means the server understood the request but refuses to authorize it. Unlike 401, the identity may be authenticated, but that identity lacks permission (authorization) for this resource, so re-logging in will not help.404Not Found common404 Not Found is the best-known status code, indicating the server cannot find the requested resource. The URL reached the server, but no resource exists at that path.405Method Not Allowed common405 Method Not Allowed is returned when the server recognizes the request's HTTP method but does not allow it for the target resource — for example sending GET to an endpoint that only accepts POST.406Not Acceptable406 Not Acceptable is returned when the server cannot produce a response in a format required by the request's Accept-family headers — that is, content negotiation failed.407Proxy Authentication Required407 Proxy Authentication Required means you must authenticate with an intermediate proxy before the request can proceed. Unlike 401, which asks for authentication to the origin server, 407 is the proxy between client and server demanding credentials.408Request Timeout408 Request Timeout means the server waited for a complete request from the client, exceeded its time limit, and closed the connection. The cause is the client sending the request line, headers, or body too slowly.409Conflict common409 Conflict means the request conflicts with the current state of the resource and cannot be processed. The request itself is well-formed, but it attempts a change incompatible with the server's present state.410Gone410 Gone declares that a resource has been permanently removed and has no forwarding address. Where 404 Not Found is a vaguer "can't find it right now", 410 is a firm "it was here, we deliberately deleted it for good, and it is not coming back".411Length Required411 Length Required means the server needs to know the size of the request body up front, but no Content-Length header was supplied, so it refuses to process the request. It happens when the server does not support chunked transfer encoding or policy requires an explicit body length.412Precondition Failed412 Precondition Failed means a condition in the request headers (If-Match, If-Unmodified-Since, etc.) evaluated to false on the server, so the request was not performed. It most commonly arises in optimistic concurrency control when someone else modified the resource first.413Content Too Large413 Content Too Large (formerly Payload Too Large) means the request body exceeds the size the server is willing to process. You hit it with file uploads, large JSON documents, or base64-encoded data.414URI Too Long414 URI Too Long means the request URI is longer than the server is willing to interpret. It is usually caused by stuffing too much data into a GET query string.415Unsupported Media Type415 Unsupported Media Type means the server rejected the request because the body's format (Content-Type) is not one it supports. For example, sending XML or text/plain to an endpoint that only accepts JSON triggers it.416Range Not Satisfiable416 Range Not Satisfiable means the byte range the client requested via the Range header lies outside the actual size of the resource. Asking for bytes at the 100 MB mark of a 5 MB file triggers it.417Expectation Failed417 Expectation Failed means the server cannot meet the expectation set in the request's Expect header — most commonly Expect: 100-continue. A client sends 100-continue to check whether the server will accept a large body before actually uploading it.418I'm a teapot418 I'm a teapot is a status code defined as an April Fools' joke in 1998 (RFC 2324, the Hyper Text Coffee Pot Control Protocol). It represents a teapot refusing a request to brew coffee: "I'm a teapot, so I can't make coffee."421Misdirected Request421 Misdirected Request means the request reached a server that cannot produce a response for that scheme/authority (host) — in other words, the request was delivered to the wrong place.422Unprocessable Content common422 Unprocessable Content (formerly Unprocessable Entity) means the request is syntactically well-formed (valid JSON, etc.) but the values it contains are semantically invalid, so the server cannot process it. It is used for validation failures such as a malformed email, a negative age, or a missing required field.423Locked423 Locked means the resource being accessed is locked (a WebDAV lock), so the request cannot proceed. WebDAV provides an explicit LOCK mechanism so collaborators do not overwrite each other's edits to the same file.424Failed Dependency424 Failed Dependency means the request could not be performed because another action it depended on failed first. In WebDAV batch or chained operations, if an earlier step fails, the dependent later steps are marked with this code.425Too Early425 Too Early means the server refused to process a request that might be replayed. It relates to TLS 1.3's 0-RTT "early data" feature.426Upgrade Required426 Upgrade Required means the server will not handle the request over the current protocol and the client must switch to a different one. The required protocol is named in the response's Upgrade header.428Precondition Required428 Precondition Required means the server requires this request to be conditional. If a client sends a write without a precondition header like If-Match, the server refuses it and demands one.429Too Many Requests common429 Too Many Requests means the client sent too many requests in a given window and hit a rate limit. The code protects the server from API abuse, excessive polling, and bot traffic.431Request Header Fields Too Large431 Request Header Fields Too Large means the request headers exceed the size the server allows, either individually or collectively. The usual culprits are oversized cookies and bloated Authorization or custom headers.451Unavailable For Legal Reasons451 Unavailable For Legal Reasons means the resource cannot be accessed due to legal demands — censorship, a court order, or government regulation. The number 451 references Ray Bradbury's novel Fahrenheit 451 about information censorship.