2xx SUCCESS
200 OK Standard success
201 Created Use after a POST that made something
204 No Content Success, deliberately empty body (DELETE, PUT)
206 Partial Content Range request (video seeking, resumable downloads)
3xx REDIRECT
301 Moved Permanently Cached HARD by browsers. Be sure.
302 Found Temporary. The default for "go here instead".
304 Not Modified Conditional GET - client's cache is still valid
307 Temporary Redirect Like 302 but the method is NOT allowed to change
308 Permanent Redirect Like 301 but the method is NOT allowed to change
4xx CLIENT
400 Bad Request Malformed - the client got the syntax wrong
401 Unauthorized Actually means UNAUTHENTICATED. Sign in.
403 Forbidden Authenticated, but not allowed
404 Not Found Also used to hide the existence of a resource
405 Method Not Allowed Right URL, wrong verb
409 Conflict Edit collision, duplicate unique key
410 Gone Deliberately deleted, do not come back
418 I'm a teapot RFC 2324. Yes, really.
422 Unprocessable Content Syntax fine, semantics wrong (validation failures)
429 Too Many Requests Rate limited - send Retry-After
5xx SERVER
500 Internal Server Error You broke it
502 Bad Gateway Upstream returned garbage
503 Service Unavailable Down or overloaded - send Retry-After
504 Gateway Timeout Upstream did not answer in time
THE ONE PEOPLE GET WRONG
401 vs 403: 401 = "I don't know who you are". 403 = "I know, and no".
302 vs 307: a 302 historically let clients turn a POST into a GET. 307 does not.