What are HTTP status codes — what 200, 404 and 500 from the server mean

Here's a hidden one: every time you open a site, the server answers not just with a page, but with a three-digit number. You usually don't see it — but it's exactly what tells you what went wrong.

200, 404, 500 — these are HTTP status codes. And here's the handy part: the first digit alone tells you whose fault it is, yours or the server's. Give it a couple of minutes and you'll read them like a traffic light.

What it actually is

When your browser (or app) knocks on a server through an API, the server has to answer. To every answer it attaches a short status code — a three-digit number.

It's like a reply from an information window. You asked — and you didn't just get a slip of paper, you got a mood with it: "here you go, found it all", "no such thing", "I broke, come back later". The code is that mood, compressed into a number.

You can skip reading the page text — the code already tells you whether the request succeeded.

The first digit decides everything

The whole trick is in the first digit. It splits every code into five families:

• 2xx — success. It worked. The most common guest is 200.
• 3xx — redirect. "Not here, go over there." The browser follows automatically.
• 4xx — error on your side. You asked for the wrong thing: bad address, no access, malformed request.
• 5xx — error on the server's side. You did everything right — it broke.

Remember that and half the panic goes away. See a 4xx — check your request. See a 5xx — it's not you; fix (or wait for) the server.

The codes you'll meet most

• 200 OK — all good, here's the answer. This is normal life.
• 301 / 302 — the page moved. 301 forever, 302 temporarily.
• 400 Bad Request — the server didn't understand the request: something's off with the format or data.
• 401 / 403 — about access. 401 is "you're not logged in", 403 is "logged in, but not allowed here".
• 404 Not Found — nothing lives at this address. The classic broken link.
• 429 Too Many Requests — you're going too fast, slow down (hello, rate limits).
• 500 Internal Server Error — the server crashed on its own bug. Not your fault.
• 502 / 503 — the server is alive but currently unreachable or overloaded. Often temporary.

Not the whole list, but 90% of what you'll actually meet.

Why it matters to you

When you build an app and it calls someone else's API, codes are your main diagnostic.

A request returned 401 — you forgot or broke the key, go check the auth. Returned 404 — you got the endpoint address wrong. Getting a stream of 429s — you're hitting the API too often, add a pause. A 500 landed — go check not your code, but the server you're calling.

The takeaway: the status code tells you immediately where to look. 4xx — fix your side, 5xx — theirs. That saves hours of blind poking. There's a dedicated look at the scariest one in what a 500 error means, and a kindred trap in how to fix a CORS error.

A real example. Your bot stopped getting data; the logs show 401. The first digit "4" shouts: it's on you. You look — the key expired. Swap the key and it's flying again. Had it been 503, you'd have dug through your own code for nothing: the server is down, so wait or use another source. The code steered you the right way and saved you an hour of blind poking.

Does 200 always mean "everything is correct"?

Not quite. 200 means "the request arrived and the server answered successfully". But the logic inside the answer might not be what you expected: an empty list, the wrong data. 200 is "the connection worked", not "you'll like the result". Check both the code and the response body.

What's the difference between 401 and 403?

401 is "I don't know who you are": not logged in or an invalid key. 403 is "I know who you are, but you're not allowed here": missing permissions. The first is fixed by logging in, the second by access rights.

Is this only about websites?

No. The same codes are used by nearly any REST API — mobile apps, bots, service-to-service integrations. Whether you open a page or your bot calls someone's service, the language of answers is the same.

What if I see a code that's not on this list?

Don't panic — the first-digit rule still holds. An unknown 4xx — fix your request; a 5xx — the problem is on the server. The exact meaning is one search away — just search "HTTP 429" — but you already know the direction from the first digit. The list above covers almost every real case; the rest are rare specifics.