I'm a Teapot

Description

Examples

BREW /pot-1 HTTP/1.1
Host: teapot.example.com
Content-Type: application/coffee-pot-command
Accept-Additions: cream;1, sugar;2

start

HTTP/1.1 418 I'm a Teapot
Content-Type: message/teapot
Content-Length: 42

I'm a teapot. I am short and stout.
Tip me over and pour me out.

GET /api/v1/coffee HTTP/1.1
Host: api.example.com
Authorization: Bearer token123
Accept: application/json

HTTP/1.1 418 I'm a Teapot
Content-Type: application/json
X-Teapot: short-and-stout

{"error": "teapot", "message": "This endpoint is a teapot. It does not, has never, and will never brew coffee.", "suggestion": "Try /api/v1/tea instead.", "rfc": "https://www.rfc-editor.org/rfc/rfc2324", "save_the_teapots": "https://save418.com"}

POST /admin/login HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
User-Agent: ScrapyBot/2.0

username=admin&password=password123

HTTP/1.1 418 I'm a Teapot
Content-Type: application/json
X-Honeypot: triggered

{"error": "teapot", "message": "This is not the endpoint you're looking for.", "your_ip_has_been_logged": true}

Edge Cases

• •418 is NOT in the IANA HTTP Status Code Registry. It has no official standing — RFC 2324 is explicitly categorized as 'Informational' and was published as a joke. Proxies and load balancers may not recognize it.
• •Some frameworks (Express, Flask, Spring) allow returning 418 without complaint. Others require explicit configuration to return non-standard status codes. Know your framework's behavior.
• •Google.com/teapot has returned 418 since at least 2013 — it's the most famous real-world deployment. The page shows an animated teapot that pours when tilted on mobile devices.
• •RFC 7168 (HTCPCP-TEA, 2014) extended the joke by adding tea-specific errors and the philosophical question of whether tea and coffee can share infrastructure. It introduced pot-designator URI schemes and tea-related media types.
• •The Node.js controversy (2017): Mark Nottingham opened an issue to remove 418 support, arguing it squats on a code number that could be used for real semantics. The community response was overwhelming — save418.com launched, and the issue was closed.
• •418 is sometimes used as a signal for intentional rejection that doesn't fit other 4xx codes — 'I understood your request perfectly, I'm just not going to do it, and the reason is fundamentally about what I AM, not what you DID.'
• •Load balancers (nginx, HAProxy, AWS ALB) may strip or replace unknown status codes. If using 418 in production, verify it survives your infrastructure stack end-to-end.
• •Some security scanners flag 418 as an anomaly. Using it as a honeypot response can trigger alert fatigue in SOC teams if not documented.

When You'll See This

• →Easter egg endpoint — a fun response for undocumented or joke routes
• →Bot detection honeypot — returning 418 to requests that hit fake admin pages
• →API versioning humor — deprecated endpoints that refuse to serve old clients
• →Load testing — a lightweight endpoint that always returns immediately with a known status
• →Developer onboarding — a simple endpoint to verify error handling code works
• →Rate limiting with personality — instead of 429, some APIs return 418 for clearly abusive patterns
• →Feature flags — temporarily returning 418 for features not yet available ('I'm a teapot, not a coffee machine yet')
• →Interview questions — 'What is HTTP 418?' is a classic ice-breaker for web developer interviews

Implementation References

History

April 1, 1998: Larry Masinter publishes RFC 2324, 'Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0).' It defines a complete protocol for controlling coffee pots over HTTP, including the BREW method, coffee-specific headers (Accept-Additions, Safe), and error code 418 for teapots that refuse to brew coffee. The RFC was intentionally absurd — specifying that the response body 'MAY be short and stout' — but it was also a commentary on the over-specification of trivial protocols. The joke aged well. As HTTP libraries proliferated in the 2000s, developers kept adding 418 to their status code constants. Python's http.client, Go's net/http, Node.js, Ruby's Rack — all include it. It became a shared cultural touchpoint. April 1, 2014: RFC 7168 extends HTCPCP to support tea (HTCPCP-TEA), adding pot-specific URI schemes, tea-related media types, and the philosophical question of whether tea and coffee can share infrastructure. 2017: The controversy. Mark Nottingham, chair of the IETF HTTP Working Group, filed an issue against Node.js to remove 418 support, arguing the code squats on registry space. The developer community revolted. save418.com launched as a campaign to preserve the teapot. The issue was closed, 418 stayed, and the incident became a case study in how developer culture can override standards governance. Today 418 persists as perhaps the only joke RFC with universal implementation — a testament to the internet's capacity for whimsy in the face of institutional seriousness.

Related Status Codes

Related Headers

FAQ