401 Unauthorized: Missing or invalid authentication credentials (identity unknown — "Who are you?"). Client should authenticate with WWW-Authenticate.
403 Forbidden: Identity known and authenticated, but lacks sufficient permissions ("I know who you are, but you're not allowed here"). Retrying with same credentials will not work.

301 Moved Permanently / 302 Found: Historical redirects. Browsers may rewrite POST to GET.
307 Temporary / 308 Permanent: Strict modern redirects. The HTTP request method (e.g. POST, PUT) and request body are guaranteed not to change.

502 Bad Gateway: Edge proxy or reverse proxy received an invalid/malformed response from upstream backend.
503 Service Unavailable: Server is overloaded or down for maintenance.
504 Gateway Timeout: Upstream backend server took too long and failed to respond in time.

400 Bad Request: Syntax error or malformed payload (e.g. invalid JSON, missing required HTTP headers).
422 Unprocessable Content: Payload syntax is valid JSON/XML, but semantically invalid (e.g. field failed validation rules, email format wrong).