All Cheat SheetsHTTP
HTTP Status Codes & Headers Reference
Complete reference for 1xx, 2xx, 3xx, 4xx, and 5xx response codes and caching headers
2xx Success Codes
Request was successfully received, understood, and accepted
200 OKStandard successful response for GET/PUT
200 OK201 CreatedResource successfully created via POST
201 Created204 No ContentAction succeeded, no response body returned (DELETE)
204 No Content4xx Client Error Codes
The request contains bad syntax or cannot be fulfilled
400 Bad RequestMalformed syntax or invalid JSON payload
400 Bad Request401 UnauthorizedAuthentication required (missing or invalid token)
401 Unauthorized403 ForbiddenAuthenticated user lacks permission for resource
403 Forbidden404 Not FoundRequested resource URI does not exist
404 Not Found409 ConflictEdit conflict or duplicate unique key constraint
409 Conflict429 Too Many RequestsRate limit exceeded; inspect Retry-After header
429 Too Many Requests5xx Server Error Codes
The server failed to fulfill an apparently valid request
500 Internal Server ErrorUnhandled backend exception or crash
500 Internal Server Error502 Bad GatewayInvalid response from upstream service or proxy
502 Bad Gateway503 Service UnavailableServer temporarily overloaded or in maintenance
503 Service Unavailable504 Gateway TimeoutUpstream database or microservice timed out
504 Gateway TimeoutEssential Caching & Security Headers
Standard HTTP headers for modern web APIs
Cache-Control (Immutable)
Cache-Control: public, max-age=31536000, immutableCache-Control (No Store)
Cache-Control: no-store, no-cache, must-revalidateCORS Allow All
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONSContent Security Policy
Content-Security-Policy: default-src 'self'