4xx Client Error Status Codes

4xx status codes are client error responses. They describe requests that are malformed, unauthorized, forbidden, too large, rate limited, or otherwise impossible for the server to process as sent.

This is an educational guide. The pages linked here are documentation pages served as 200 OK, even when the HTTP status code being explained is an error response.

What 4xx means

Client error responses mean the server understood enough of the request to decide that the client must change something before the request can succeed.

Where 4xx responses appear

The request is malformed, missing needed data, or too large.
The user is unauthenticated, unauthorized, or blocked by policy.
The target resource does not exist, has moved, or is legally unavailable.
The request conflicts with current resource state or rate limits.

Implementation notes

Prefer specific 4xx responses so clients know what to change.
Use 401 for missing or failed authentication and 403 for authenticated requests that are still forbidden.
Use 404 for missing resources and 410 when the removal is intentional and permanent.

Common 4xx groups

Request syntax and validation: 400, 411, 413, 422
Authentication and authorization: 401, 403, 407
Missing, removed, or blocked resources: 404, 410, 451
Rate limits and timing: 408, 425, 429

Compare similar 4xx codes

401 vs 403: Unauthorized or Forbidden?

Use 401 when the client should authenticate. Use 403 when the client is authenticated or known, but still not allowed.

Question	401 Unauthorized	403 Forbidden
Main problem	Authentication missing, invalid, or expired.	Authorization denied for this resource or action.
Client action	Log in, refresh token, or send credentials.	Do not retry unless permissions change.
Header	Usually includes WWW-Authenticate.	Usually does not challenge authentication.

400 vs 411 vs 413 vs 422 Request Errors

Use these 4xx codes to separate invalid syntax, missing request length, oversized bodies, and well-formed requests that fail business validation.

Code	Main problem	First fix
400	The request is malformed or cannot be parsed.	Fix syntax, headers, routing, or body shape.
411	The server requires Content-Length before reading the body.	Send Content-Length or use a supported upload method.
413	The request body is larger than the server accepts.	Reduce the payload or raise documented limits safely.
422	The request parses correctly but fails semantic validation.	Change the submitted values according to field-level errors.

Rules for every 4xx response

What RFC 9110 says about every 4xx response, quoted from the RFC.

SHOULD (server; content): Send a representation explaining the error and whether it is temporary or permanent. When: Any request except HEAD. Table row
Except when responding to a HEAD request, the server SHOULD send a representation containing an explanation of the error situation, and whether it is a temporary or permanent condition. RFC 9110 §15.5

The same rule is in the response obligations table and its JSON.

For an API, an RFC 9457 Problem Details body is one standard way to send that explanation.

All 4xx status codes

Code	Name	Meaning
400	Bad Request	The server cannot or will not process the request because of something it sees as a client error, such as malformed syntax, invalid framing, or deceptive routing.
401	Unauthorized	The request lacks valid authentication credentials for the target resource. The response must include a WWW-Authenticate challenge.
402	Payment Required	Reserved for future use. The original intention was that this code might be used as part of some form of digital cash or micropayment scheme, as proposed, for example, by GNU Taler, but that has not yet happened, and this code is not widely used. Google Developers API uses this status if a particular developer has exceeded the daily limit on requests. Sipgate uses this code if an account does not have sufficient funds to start a call. Shopify uses this code when the store has not paid their fees and is temporarily disabled. Stripe uses this code for failed payments where parameters were correct, for example blocked fraudulent payments.
403	Forbidden	The server understood the request but refuses to fulfill it. Sending the same credentials again will not help.
404	Not Found	The origin server did not find a current representation for the target resource, or is not willing to say that one exists.
405	Method Not Allowed	The server knows the request method, but the target resource does not support it. The response must include an Allow header.
406	Not Acceptable	The requested resource is capable of generating only content not acceptable according to the Accept headers sent in the request. See Content negotiation.
407	Proxy Authentication Required	The client must first authenticate itself with the proxy.
408	Request Timeout	The server timed out waiting for the request. According to HTTP specifications: "The client did not produce a request within the time that the server was prepared to wait. The client MAY repeat the request without modifications at any later time."
409	Conflict	The request conflicts with the current state of the target resource. The client may be able to resolve the conflict and resubmit.
410	Gone	The target resource is no longer available at the origin server, and the condition is likely to be permanent.
411	Length Required	The request did not specify the length of its content, which is required by the requested resource.
412	Precondition Failed	One or more conditions in the request header fields evaluated to false on the server.
413	Content Too Large	The request content is larger than the server is willing or able to process. RFC 7231 called this 413 Payload Too Large, and RFC 2616 called it 413 Request Entity Too Large.
414	URI Too Long	The URI provided was too long for the server to process. Often the result of too much data being encoded as a query-string of a GET request, in which case it should be converted to a POST request. Called "Request-URI Too Long" previously.
415	Unsupported Media Type	The server refuses the request because the content is in a format this method on the target resource does not support.
416	Range Not Satisfiable	The client has asked for a portion of the file (byte serving), but the server cannot supply that portion. For example, if the client asked for a part of the file that lies beyond the end of the file. Called "Requested Range Not Satisfiable" previously.
417	Expectation Failed	The server cannot meet the requirements of the Expect request-header field.
418	I'm a teapot	This code was defined in 1998 as one of the traditional IETF April Fools' jokes, in RFC 2324, Hyper Text Coffee Pot Control Protocol, and is not expected to be implemented by actual HTTP servers. The RFC specifies this code should be returned by teapots requested to brew coffee. This HTTP status is used as an Easter egg in some websites, such as Google.com's I'm a teapot easter egg.[53]
421	Misdirected Request	The request was directed at a server that is not able to produce a response (for example because of connection reuse).
422	Unprocessable Content	The server understands the content type and the syntax is correct, but it cannot process the instructions in the request. RFC 4918 called this 422 Unprocessable Entity.
423	Locked	The resource that is being accessed is locked.
424	Failed Dependency	The request failed because it depended on another request and that request failed (e.g., a PROPPATCH).
425	Too Early	Indicates that the server is unwilling to risk processing a request that might be replayed.
426	Upgrade Required	The client should switch to a different protocol such as TLS/1.3, given in the Upgrade header field.
428	Precondition Required	The origin server requires the request to be conditional. Intended to prevent the 'lost update' problem, where a client GETs a resource's state, modifies it, and PUTs it back to the server, when meanwhile a third party has modified the state on the server, leading to a conflict.
429	Too Many Requests	The user has sent too many requests in a given amount of time (rate limiting).
431	Request Header Fields Too Large	The server is unwilling to process the request because either an individual header field, or all the header fields collectively, are too large.
451	Unavailable For Legal Reasons	A server operator has received a legal demand to deny access to a resource or to a set of resources that includes the requested resource. The code 451 was chosen as a reference to the novel Fahrenheit 451 (see the Acknowledgements in the RFC).
499	Client Closed Request	Used by nginx to log a request whose client closed the connection before nginx sent the response header.