HTTP 200 OK

What 200 means

When a 200 is actually a problem

• An API returns 200 with {"success": false} or {"error": "..."}. Monitoring, retry libraries, caches and SDKs all treat it as a success.
• A single-page app or catch-all route answers unknown URLs with 200 and a "Page not found" screen. That's a soft 404.
• A login wall, consent page or captcha is served with 200 in place of the requested content, so a CDN caches it and crawlers index it.
• A captive portal or corporate proxy returns its own 200 HTML page in place of your API's JSON, and response.json() throws Unexpected token '<'.
• GraphQL APIs often return 200 with an errors array. That's normal for GraphQL, but your client has to check the array, not just the status.

How to check and fix it

# Status line and headers (HEAD request)
curl -sI https://example.com/missing-page

# Status code of a real GET, following redirects
curl -s -o /dev/null -L -w '%{http_code}\n' https://example.com/missing-page

app.get('/api/orders/:id', async (req, res) => {
  const order = await db.orders.find(req.params.id);
  if (!order) {
    return res.status(404).json({ error: 'order_not_found' });
  }
  res.json(order); // 200 is the default
});

import { notFound } from 'next/navigation';

export default async function Page({ params }: { params: Promise<{ slug: string }> }) {
  const { slug } = await params;
  const post = await getPost(slug);
  if (!post) notFound(); // 404, renders app/not-found.tsx
  return <Article post={post} />;
}

Headers that matter with 200

Cache-Control

Decide caching explicitly. Without it, caches may store a 200 heuristically, often for 10% of the time since Last-Modified.

ETag / Last-Modified

Let clients revalidate with a conditional request and get a bodiless 304 instead of downloading the whole thing again.

Content-Type

application/json; charset=utf-8 for APIs. A wrong type makes browsers and clients misinterpret a perfectly good 200 body.

200 vs similar status codes

• 201 Created: Use 201 when a POST (or PUT) created a new resource, plus a Location header. A 200 still works, but the client can't tell anything was created.
• 204 No Content: Use 204 when the success has no body. A 200 with an empty body leaves the client guessing whether to parse it.
• 304 Not Modified: A revalidated cache hit. Browsers turn a 304 into the cached 200 before your JavaScript sees it, so fetch() reports 200 even when the network returned 304.

SEO impact of 200

Search engines only index URLs that return 200, or that redirect to one. A 200 on a page that says "not found" or is nearly empty is reported as a soft 404 in Google Search Console and wastes crawl budget. Return a real 404 or 410 for missing content.

Related status codes

Looking for another code? Search the full HTTP status codes list, or read which code your API should return in the REST API status codes guide.

Learn more

Browse all developer guides →

Frequently Asked Questions