The codes that actually page you
Use this when a log line says 429 or 503 and you want the name and class without opening a second encyclopedia. Type a fragment — 404, gateway, too many — and the ledger filters. This is a working subset: the codes people hit in APIs, CDNs, and browsers. It is not the full IANA list. For semantics (what a redirect means, what a cache must do, how authentication challenges work) the source is RFC 9110. For “is this number assigned,” use the IANA HTTP status code registry.
The unique failure is treating the number as the outage. 502 and 503 both look like “site down” in a screenshot. One is a proxy that got garbage from origin. The other is origin saying it cannot serve. You debug different boxes. Same trap: 301 vs 302 in an SEO thread that has been “temporary” for fourteen months, or 401 vs 403 in a login form that retries forever.
Worked example: 301 vs 302 vs 308
You moved /old to /new. 301 Moved Permanently is cached by clients and is the usual “this URL is dead, use the new one” signal. 302 Found is temporary; crawlers and browsers may keep hitting /old. 308 Permanent Redirect is the method-preserving cousin of 301: a POST stays a POST, which matters for forms and APIs. 307 Temporary Redirect is the method-preserving cousin of 302. If a marketing short link has been 302 for a year, you did not make a temporary move. You made a sticky one with the wrong code. RFC 9110 §15 is the prose; this table is the names.
Worked example: 429 at 10,000 requests
A client sends 10,000 requests in a minute to an API that allows 60. The origin answers 429 Too Many Requests. The fix is back off, honor Retry-After if present, and stop retrying in a tight loop. 429 is not “the site is down.” 429 is “you are the incident.” If you instead see 503 Service Unavailable with the same traffic, the origin may be collapsing under load — still your traffic, different lever (shed load, scale, fail a health check). Do not swap the codes in a runbook. A pager that says 429 on a partner API is a throttle. A pager that says 503 on your own origin is an outage until proven otherwise.
Worked example: 502 vs 503 vs 504, and 401 vs 403
502 Bad Gateway: a proxy (CDN, load balancer, nginx) got an invalid response from upstream. Debug the hop behind the proxy. 503: origin (or a deliberately failed health check) is unavailable. 504 Gateway Timeout: the proxy waited and upstream did not answer in time — look at origin duration, not at “DNS is down” first. 401 Unauthorized: send credentials, or send better ones. 403 Forbidden: credentials were understood and still refused (or a WAF did not like your face). Sending a 403 user to a login page that 401s in a loop is a classic frontend bug. 304 Not Modified is a cache hit, not an error; celebrating a wall of 304s in an access log is allowed.
What this table omits on purpose
Uncommon codes, WebDAV extras, and anything assigned after I last edited the list. 418 I'm a teapot is here because people search for it; it is not a diagnosis. Filter is substring on code, name, and class. It will not explain your stack trace, replay a request, or fetch IANA live. If a vendor invents 520, that is their fan-fiction, not RFC 9110. Read the vendor docs. For the codes that are actually HTTP, start with RFC 9110, then this ledger for the name you already half-remember.
Where do these codes come from?
Semantics: RFC 9110 (HTTP Semantics). Assignments: the IANA HTTP status code registry. Both are linked in the trust rail. This table is a subset of codes people actually hit.
301 vs 302 vs 308 for a URL move?
301 is a cached permanent move. 302 Found is temporary. 308 Permanent Redirect keeps the method (POST stays POST). 301/308 are the usual SEO pair; 302 is how “temporary” leaks into a year-old redirect.
429 vs 503 — which is my outage?
429 Too Many Requests: you (or a client) exceeded a rate limit; back off, honor Retry-After. 503 Service Unavailable: the origin is overloaded or down. 502 is a proxy that got a bad answer; 504 is a proxy that waited too long.
401 vs 403?
401 Unauthorized: not authenticated (or bad credentials). 403 Forbidden: authenticated (or not) and still not allowed. Sending users to “log in” on a 403 is how you loop a session.
Why is 418 in the table?
I'm a teapot, from the April fool RFC 2324, still in IANA. It is not a load-balancer diagnosis. The filter is here because people search for it.
Is this table fetched live from IANA?
No. It is a static subset on the page. If you need a code I omitted, read RFC 9110 and the IANA registry — not this filter box.