What the first digit actually tells you

HTTP status codes are grouped into five classes by their leading digit, and that digit alone carries real meaning even before reading the specific code: 1xx is purely informational (the request is still being processed), 2xx means success, 3xx means the client needs to take further action (usually following a redirect), 4xx means the client did something the server won't accept, and 5xx means the server itself failed to fulfill an otherwise valid request. This is why "what class is this in" is often the fastest first question to ask about an unfamiliar code — a 4xx says "check what you sent," a 5xx says "look at the server," and that distinction alone often points straight at where to start debugging.

The codes that trip people up most

• 401 vs. 403 — 401 Unauthorized actually means "you're not authenticated" (despite the name, it's about identity, not permission); 403 Forbidden means "you're identified, but not allowed." Mixing these up in your own API responses is a common source of confused client-side error handling.
• 301 vs. 302 vs. 307/308 — 301/308 are permanent redirects, 302/307 are temporary. The additional 307/308 distinction (vs. the older 301/302) is that they guarantee the request method and body are preserved on redirect, which the older codes technically don't guarantee across all clients.
• 502 vs. 503 vs. 504 — all three indicate a problem somewhere behind a reverse proxy or load balancer, but they mean different things: 502 Bad Gateway is an invalid response from the upstream, 503 Service Unavailable usually means deliberate overload/maintenance, and 504 Gateway Timeout means the upstream simply never responded in time.