Is the Location header required on 201?
It is strongly expected. RFC 9110 says the primary new resource is identified by Location, or by the request URL if Location is absent. Clients and API tools rely on it to find what was created.
HTTP 201 CREATED
A new resource was created. The Location header usually points to it. 201 belongs to the 2xx success class and is defined in RFC 9110.
Loading the workbench.
About HTTP 201
What Does HTTP 201 Created Mean?
A new resource was created. The Location header usually points to it. The code is registered with IANA and defined in RFC 9110.
Success: the request was received, understood, and accepted. Every code from 200 to 299 shares that general meaning, so a client that does not recognise 201 must treat it like 200.
When Do You See a 201 Response?
201 Created means the request made a new resource. It is the textbook answer to a POST that adds an item to a collection, such as creating a user or an order, and to a PUT that creates something at a URL that did not exist before. REST frameworks often default to 200 for every success, so seeing 201 usually means the API was designed with care. The new resource is identified by the Location header.
How Do You Handle a 201?
Servers should include a Location header with the URL of the new resource, and usually return its representation or at least its ID in the body so the client does not need another round trip. Add an ETag if the body is the full current representation. Clients should read the identifier from Location or the body rather than guessing it. If the POST is retried after a network error, an idempotency key prevents creating duplicates.
What Does a 201 Response Look Like?
HTTP/1.1 201 Created
Location: /api/orders/8841
Content-Type: application/json201 is not cacheable by default: a browser or CDN stores it only when Cache-Control or Expires explicitly allows it.
To inspect a real one without sending it anywhere:
- Copy the response headers from your browser Network tab, or from
curl -i. - Paste them into the Header decoder to see every header explained.
- Check caching in the Cache lane.
Which Status Codes Are Related to 201?
- 200 OK: The request succeeded. The body depends on the method.
- 202 Accepted: The request was queued but not finished. Common for background jobs.
- 409 Conflict: The request conflicts with the current state, such as an edit conflict or a duplicate.
- 303 See Other: Go GET a different URL, typically after a form POST (post/redirect/get).
Browse every code on the HTTP status codes page.
What Other Lanes Are in the Reference Section?
- HTTP status codes: Every IANA-registered status code, with a page per code.
- MIME types: File extensions to Content-Type, searchable both ways, plus a Content-Type parser.
- HTTP methods: GET, POST, PUT, PATCH, DELETE and the rest: safe, idempotent, cacheable.
Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Should a PUT return 201 or 200?
Return 201 when the PUT created a resource that did not exist, and 200 or 204 when it replaced an existing one. The difference tells the client which case happened.
Is HTTP 201 an error?
No. 201 is a success response, not an error.
Is a 201 response cacheable by default?
No. Caches store a 201 only when Cache-Control or Expires explicitly allows it.
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
- Click the clear icon in the Network tab so that the log is empty.
- Paste real headers into any lane and read the result.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.
Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.