HTTP Status Code Reference

401 means the server doesn't know who you are — no credentials or invalid ones; authenticating can fix it. 403 means it knows exactly who you are and the answer is still no; better credentials won't help, permissions will. The names (Unauthorized vs Forbidden) are historically swapped from their meanings, which is why everyone confuses them once.

A 502 comes from a proxy or load balancer (nginx, Cloudflare) that reached out to your actual application and got garbage or nothing back. So the proxy is fine; the app behind it crashed, isn't listening, or is timing out — check the application process and its logs first.

Convention: 400 for requests the server can't even parse (malformed JSON, missing required structure), 422 for requests that parse fine but fail validation (email field isn't an email). Plenty of APIs use 400 for both; consistency within your API matters more than the distinction.

Genuinely — RFC 2324 (1998), an April Fools spec for the Hyper Text Coffee Pot Control Protocol. It's not part of HTTP proper, but enough servers implement it that it's become the standard easter egg, occasionally pressed into service for blocking unwanted traffic with style.