The symbol is the API, the number is the wire

In a Rails controller the status is a symbol, and Rack owns the list. render json: invoice, status: :created, head :no_content and redirect_to url, status: :see_other all pass their symbol through Rack::Utils.status_code, which looks it up in SYMBOL_TO_STATUS_CODE and hands the integer to the server. The symbol is the API you write against; the number is what goes over the wire. Two of those symbols were renamed in Rack 3.1 to match the current specification: :unprocessable_entity became :unprocessable_content and :payload_too_large became :content_too_large. The old names still work and still resolve to 422 and 413, but Rack now emits a deprecation warning when you use one, so a log full of them is a rename waiting to happen rather than a bug. The table below shows the canonical symbol for every code Rack knows, and the former name alongside it where there is one.

The statuses Rails picks for you

Plenty of statuses are chosen for you. ActionDispatch::ExceptionWrapper keeps a rescue_responses map that turns an uncaught exception into a status: ActiveRecord::RecordNotFound becomes 404, ActionController::ParameterMissing becomes 400, and ActiveRecord::RecordInvalid and ActionController::InvalidAuthenticityToken both become 422. So a controller that calls Invoice.find(params[:id]) already answers 404 for a missing row without a rescue anywhere, and one that calls update! already answers 422 on a validation failure. You can add your own with config.action_dispatch.rescue_responses["MyApp::Forbidden"] = :forbidden, which is the cleanest way to keep an authorisation failure out of every controller. The one status worth choosing by hand is the failure branch of a form: Turbo only swaps the page when the response is not successful, so a create that re-renders the form must answer :unprocessable_content rather than 200, or the visitor sees the submit do nothing at all.

What a redirect chain costs, and where a loop comes from

A redirect chain costs a request per hop, and every hop is a round trip the visitor waits through before anything renders. 301 and 308 say the move is permanent and let a crawler transfer the old URL's signals to the new one; 302, 303 and 307 say it is temporary and keep the old address in the index. The pairs differ in one more way: a client may turn a redirected POST into a GET on 301, 302 and 303, and must not on 307 and 308, which is why an API endpoint that has moved wants 308 rather than 301. In a controller that is redirect_to new_path, status: :permanent_redirect. Chains grow by accident - a http to https rule, then a bare domain to www rule, then a trailing-slash rule, each added by somebody who could not see the other two - and each one multiplies. A loop is the same mistake with the last hop pointing back at the first, which this tool marks where it happens. Collapse the chain to a single hop where you can: the tool stops following at 5 hops and a crawler gives up at about the same depth.

Every HTTP status code and its Rack symbol

The symbol in the second column is what you pass to render, head or redirect_to. It comes straight from the Rack your app is running, so it is the list your Rails version actually accepts rather than a copy that has drifted. Where a symbol was renamed, the former name is shown underneath it.

Questions about status codes in a Rails app