203 Non-Authoritative Information

HTTP 203 Non-Authoritative Information indicates that the request succeeded, but the response headers or payload were modified or supplied by a transforming proxy rather than passed through unchanged from the origin server. It exists specifically so clients can tell the difference between an authoritative 200 straight from the source and a response that has been altered somewhere along the way, for example a proxy that rewrote timestamps, added tracking headers, stripped fields for privacy, or served a cached copy assembled from multiple upstream calls.

In practice 203 is rare; most transforming proxies, whether corporate content filters, ad-stripping middleboxes, or API aggregation layers, simply return 200 without flagging the transformation, which technically understates what happened but causes no functional problems for most clients. Where 203 is used deliberately, it tends to be in API gateways or edge caches that combine data from several backend services into one response and want to signal that the combined payload is not a verbatim copy of any single origin's output.

Because 203 behaves like 200 for caching and content negotiation purposes, and carries no special handling requirement in most HTTP client libraries, applications rarely need custom logic for it beyond recognizing that the metadata may be approximate. Systems that care about strict data provenance, such as compliance or audit tooling, are the main audience that benefits from distinguishing 203 from 200, since it flags responses whose headers should not be treated as authoritative for things like exact last-modified times.