Skip to main content
Response Classes breaks down HTTP status codes the CDN returned to clients. The non-2xx panel surfaces problems — bad URLs, blocked traffic, origin failures — before users complain.
Response Classes

​
Status code map

ClassMeaningCommon causes
2xxSuccessHealthy traffic.
3xxRedirectHTTP→HTTPS, canonical-URL redirects.
4xxClient error404 for missing assets, 403 from access rules, 429 rate-limited.
5xxServer errorOrigin down, TLS handshake failed, edge timeout.

​
How to read the panel

ElementMeaning
4xx counterCount of client-side errors in the window. Yellow series.
5xx counterCount of server-side errors. Red series.
Time-series chartDistribution over time — find spikes.

​
Pull via API

curl -sS "https://api.tenbyte.io/cdn/distributions/$DISTRIBUTION_ID/analytics/responses?from=2026-05-01T00:00:00Z&to=2026-05-09T00:00:00Z&granularity=hour" \
  -H "Authorization: Bearer $TENBYTE_API_TOKEN" | jq

{
  "totals": {"2xx": 4456012, "3xx": 12000, "4xx": 33000, "5xx": 222},
  "series": [
    {"ts": "2026-05-01T00:00:00Z", "2xx": 1923000, "4xx": 1500, "5xx": 12}
  ]
}

​
Diagnose a 4xx spike

StatusLikely causeAction
404Stale URLs after a deploy, broken <img> srcset, robots probing.Audit recent deploys, fix references, consider a 404 cache rule.
403Access rule blocked the request.Inspect rule logs; verify intended audience can pass.
401Origin rejected an auth-protected path.Check upstream credentials.
405Method not allowed.Origin or rule disallows verb (often OPTIONS preflight).
429Rate limit hit.Check origin throttling and edge protection settings.

​
Diagnose a 5xx spike

StatusLikely causeAction
502Origin unreachable, dropped connection, TLS failure.Check origin health and certs.
503Origin overloaded or returning Retry-After.Scale origin; consider edge Retry-After aware caching.
504Edge timed out waiting for origin.Investigate origin latency; raise timeouts only as a last resort.

​
Operational tips

  • Alert on rate, not absolute count. 5xx > 0.1% of requests for 5 min beats a fixed threshold across distributions of different size.
  • Correlate with deploys. Most 4xx spikes are deploys with stale paths; first action on a spike is “what shipped?”
  • Cache 404s briefly. A short TTL on 404 cuts origin load during a probe storm. Configure via cache rules.
  • Watch the edge → origin TLS expiry. A silent cert renewal failure shows up as 502.
  • Combine with Cache hit ratio. Falling CHR + rising 5xx = origin couldn’t keep up with the cold-start spike.