What do the HTTP status code classes mean? Name the key codes.
Take a moment.
Say your answer out loud or write it down first — retrieval is what makes it stick. Reveal when you're ready.
Short answer
1xx informational, 2xx success (200 OK, 201 Created, 204 No Content), 3xx redirection (301 permanent, 302 temporary, 304 Not Modified), 4xx client error (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests), 5xx server error (500, 502 Bad Gateway, 503 Service Unavailable). The class tells who must act: client fixes 4xx, server owner fixes 5xx.
Detailed explanation
The first digit is the contract. 2xx means the server did what was asked: 200 with a body, 201 when something was created (include a Location header), 204 when there is nothing to return. 3xx means go look elsewhere: 301/308 are permanent (browsers and SEO update bookmarks), 302/307 temporary; 304 is special — the cached copy is still fresh, send nothing (the backbone of conditional caching). 4xx blames the request: 400 malformed input, 401 missing/invalid authentication (despite the name, it means unauthenticated), 403 valid auth but forbidden, 404 unknown resource, 409 conflict with current state, 429 rate-limited (honor Retry-After). Clients must not blindly retry 4xx — the request itself is wrong. 5xx blames the server: 500 unhandled crash, 502 upstream/gateway failure, 503 temporarily overloaded (also sends Retry-After). Clients may retry 5xx with backoff, and 503 is the correct code for deploys and maintenance windows. Practical discipline: APIs should return the most specific code available, keep error bodies in one consistent shape (code, message, details), and never leak stack traces in 500s.
Example
# Creating a user — full status-code conversation
# → POST /users { "email": "a@x.com" }
# ← 201 Created, Location: /users/8
# → GET /users/999
# ← 404 Not Found { "code": "user_not_found", "message": "No user with id 999" }
# → GET /users/8 (with If-None-Match: "v3")
# ← 304 Not Modified (use your cached copy, zero bytes transferred)Interview tip
Recite the five classes in one breath, then nail the pairs people confuse: 401 vs 403, 301 vs 302, 400 vs 404. That precision is what interviewers score.
Common mistakes
- Mixing up 401 (unauthenticated) and 403 (forbidden).
- Retrying 4xx errors that will never succeed without changing the request.
- Returning 200 with an error body instead of the proper 4xx/5xx.