QAing reference · Aug 2026
HTTP Status Codes for Testers
An HTTP status code summarises the result of a request. Test the code together with the response body, headers and actual system state.
| Code | Meaning | Verify |
|---|
200 | OK | Correct body, headers and data. |
201 | Created | Resource exists and its location or ID is returned. |
202 | Accepted | Processing is asynchronous and status can be tracked. |
204 | No Content | Action succeeded and no response body is returned. |
301 | Permanent redirect | Clients and search engines should use the new URL. |
302 | Temporary redirect | Original URL remains valid. |
304 | Not Modified | Cached content is reused correctly. |
307 / 308 | Temporary / permanent redirect | Method and body are preserved. |
400 | Bad Request | Invalid input gets a safe, useful error. |
401 | Unauthenticated | Missing or invalid credentials are rejected. |
403 | Forbidden | Authenticated user lacks permission. |
404 | Not Found | Unknown resources do not leak details. |
405 | Method Not Allowed | Unsupported methods are rejected. |
409 | Conflict | Duplicate or state conflict is explained. |
415 | Unsupported Media Type | Wrong Content-Type is rejected. |
422 | Unprocessable Content | Well-formed but invalid data reports field errors. |
429 | Too Many Requests | Rate limit and retry information are correct. |
500 | Internal Server Error | No stack trace, secret or internal detail is exposed. |
502 | Bad Gateway | Upstream failure is handled and retry is safe. |
503 | Service Unavailable | Maintenance or overload response is clear. |
504 | Gateway Timeout | Slow dependency produces a controlled response. |
- Expected code for both valid and invalid requests.
- Response schema, values and error format.
Content-Type, caching, CORS and security headers.- No sensitive information in errors.
- Database or system state matches the result.
- Redirect target, number of hops and preserved method.
- Retry behaviour is safe and does not create duplicates.
Common mistake: a 200 response can still contain the wrong data. A 500 may hide a partial write. Always verify the outcome.