200 OK

Success: the request was received, understood and accepted.

When a server should send it. For every successful request whose response carries the result: a page, a file, the outcome of an API call. A missing page, a failed login or an empty search result shown with 200 is misreported, and crawlers call that a soft 404.

Common causes. A normal page load or API call.

What to do. Nothing. For an API that returns an error message with 200, the server is misreporting the result and the client has to read the body to know.

Browsers and HTTP clients. Browsers render the body. HTTP libraries treat 2xx as success and do not throw. A 200 for a POST describes the outcome of the action, not a stored copy of something.

Google Search. Google passes the content on for indexing. If the page looks like an error (empty, or a "not found" message), Search Console reports it as a soft 404. Source: Google Search Central, How HTTP status codes, and network and DNS errors affect Google Search.

Caching. Cacheable by default (RFC 9110 section 15.1). With no Cache-Control or Expires header, a cache may still store it and reuse it for a heuristic period, often 10% of the time since Last-Modified, so set Cache-Control explicitly if that is not what you want.

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=300

OK

location /example {
    return 200 'OK';
}

http_response_code(200);
echo 'OK';
exit;

res.writeHead(200, { 'Content-Type': 'text/plain' });
res.end('OK');

# in a view function
return 'OK', 200