HTTP Status Codes

401 Unauthorized means the server does not know who you are. The credentials are missing, or the token is expired or invalid, so the request cannot be identified at all. It is an invitation to authenticate and try again, and the response must carry a WWW-Authenticate header naming the scheme. 403 Forbidden means the server knows exactly who you are and refuses anyway. The identity is valid but lacks the permission for this action, so retrying with the same identity will never help. One subtlety, if merely revealing that a resource exists is a risk, return 404 instead of 403 so you do not confirm it to someone who should not know.

400 Bad Request is for a request the server cannot even parse or accept structurally, malformed JSON, a missing required field, a bad header. The shape of the request is wrong and must be corrected. 422 Unprocessable Content is for a request that is perfectly formed but fails a validation or business rule, an email already taken, a value out of range, a date in the past. The server understood it completely and still cannot act on it. Neither is retryable without changing the request itself, and a related case, 409 Conflict, is for a request that is valid but clashes with the current state.

Both say not right now, for different reasons. 429 Too Many Requests points at this one client, you have exceeded your rate limit, slow down. 503 Service Unavailable points at the whole server, it is overloaded or in maintenance and cannot serve anyone. Both should send a Retry-After header telling the client how long to wait, and both are safe to retry once that delay passes.

404 Not Found means the server has no representation for this address and makes no promise about whether it ever did or ever will. 410 Gone is a deliberate, stronger statement, the resource existed and has been permanently removed, so clients and search engines should stop asking. Reach for 410 only when the removal is genuinely permanent, otherwise 404 is the safer default.

All three redirect, they differ on permanence and on whether the method survives. 302 Found is temporary, and historically clients switch the method to GET on the follow-up, which silently breaks a POST. 307 Temporary Redirect is the safe temporary choice, it preserves the method and body. 308 Permanent Redirect is the modern permanent choice, like 301 but guaranteed to keep the method.