423 Locked
The resource is locked by WebDAV and cannot be modified until the lock is released or a valid lock token is supplied.
At a glance
- Status code
- 423 Locked
- Class
- 4xx, client error, the request itself is the problem
- Defined in
- RFC 4918
- Cacheable by default
- no
- Response body
- Should identify the lock.
In detail
WebDAV supports explicit locks so two editors do not overwrite one another. 423 is the server enforcing one.
Outside WebDAV it is sometimes borrowed for application-level locks, such as a record open in an approval workflow. Document what releases the lock.
Supply the lock token in an If header, or wait for the lock to expire. Locks have timeouts precisely so a crashed client does not block a resource forever.
Examples
HTTP/1.1 423 Locked
Content-Type: application/xml
<error><lock-token-submitted/></error>Things that catch people out
- A lock that never expires is a permanent outage waiting to happen. Always set a timeout.
- 423 is not a rate limit and clients should not back off and retry blindly. The lock clears on an event, not on a timer the client can guess.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →409 Conflict
The request clashes with the current state of the resource, for example an edit based on a version that has since changed.
424 Failed Dependency
The request failed because an earlier request it depended on failed, so this one was never attempted.
403 Forbidden
The server understood the request and refuses to fulfil it. Unlike 401, sending different credentials will not help.
425 Too Early
The server refuses to process a request sent in TLS 1.3 early data, because early data can be replayed by an attacker.
426 Upgrade Required
The server refuses to serve this request over the current protocol and names, in the Upgrade header, what it will accept.
428 Precondition Required
The server requires the request to be conditional, and refuses an unconditional one to prevent a lost update.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL