Free tool for product managers
Every API response and web page comes with a three-digit status code. Type a code or search a word to see what it means in product terms, what usually causes it, what the user should see, and who can fix it.
The server received the start of a request and the client can send the rest.
The request worked.
Something new was created — an order, a task, an account.
The request was accepted but the work happens later in the background.
It worked and there is nothing to return.
This URL has moved for good; browsers and Google should use the new one.
Go to another URL for now; the original URL stays valid.
The browser already has the latest version cached.
Like 302, but the request method (e.g. POST) is kept.
Like 301, but the request method is kept.
The request was invalid — missing, wrong or malformed data.
Not signed in — the login token is missing, invalid or expired.
Reserved for payment situations; some APIs use it for billing problems.
Signed in, but not allowed to do this.
The thing does not exist — or the user is not supposed to know it exists.
This URL does not support that action (e.g. DELETE on a read-only endpoint).
The server waited too long for the request.
The request clashes with the current state.
It existed but has been removed permanently.
The upload or request is too big.
The server does not accept this format.
The format is fine but the data breaks a rule.
Rate limited — too many requests in a short time.
Blocked for legal reasons, such as a court order or sanctions.
Something crashed on the server — a bug or unhandled case.
The server does not support this feature.
A server in the middle got an invalid response from the one behind it.
The service is temporarily down or overloaded.
A server in the middle waited too long for another one.
The first digit tells you almost everything:
| Range | Meaning | Usually whose problem |
|---|---|---|
| 1xx | Informational — still in progress | Rarely seen in products |
| 2xx | Success | Nobody's — if the screen is wrong anyway, look at the frontend |
| 3xx | Redirect — go somewhere else | Configuration, SEO, domain setup |
| 4xx | The request was wrong or not allowed | Client side: input, login, permissions, limits |
| 5xx | The server failed | Backend, infrastructure or a third-party service |
Good acceptance criteria describe what happens on failure, not only on success. For example:
Agents often write the happy path and a generic "Something went wrong". Ask explicitly: "Handle 401, 403, 404, 409, 429 and 5xx separately with these messages… Never show raw error text to users; log the details for us." Then test each case — many are easy to trigger by signing out, using a second account or disconnecting the network.
Learn more in APIs for product managers and authentication and authorization for product managers.
No credit card. Open the first week as a guest, create a free account to save progress and unlock week 2 and the AI mentor.