2xx SUCCESS
  200 OK                      Standard success
  201 Created                 Use after a POST that made something
  204 No Content              Success, deliberately empty body (DELETE, PUT)
  206 Partial Content         Range request (video seeking, resumable downloads)

3xx REDIRECT
  301 Moved Permanently       Cached HARD by browsers. Be sure.
  302 Found                   Temporary. The default for "go here instead".
  304 Not Modified            Conditional GET - client's cache is still valid
  307 Temporary Redirect      Like 302 but the method is NOT allowed to change
  308 Permanent Redirect      Like 301 but the method is NOT allowed to change

4xx CLIENT
  400 Bad Request             Malformed - the client got the syntax wrong
  401 Unauthorized            Actually means UNAUTHENTICATED. Sign in.
  403 Forbidden               Authenticated, but not allowed
  404 Not Found               Also used to hide the existence of a resource
  405 Method Not Allowed      Right URL, wrong verb
  409 Conflict                Edit collision, duplicate unique key
  410 Gone                    Deliberately deleted, do not come back
  418 I'm a teapot            RFC 2324. Yes, really.
  422 Unprocessable Content   Syntax fine, semantics wrong (validation failures)
  429 Too Many Requests       Rate limited - send Retry-After

5xx SERVER
  500 Internal Server Error   You broke it
  502 Bad Gateway             Upstream returned garbage
  503 Service Unavailable     Down or overloaded - send Retry-After
  504 Gateway Timeout         Upstream did not answer in time

THE ONE PEOPLE GET WRONG
  401 vs 403: 401 = "I don't know who you are". 403 = "I know, and no".
  302 vs 307: a 302 historically let clients turn a POST into a GET. 307 does not.