423 Locked

Attempts to modify a locked file or folder result in the 423 Locked status code.

Table of Contents

Usage

The 423 Locked error is part of Webdav, used as a file system over HTTP. Clients have the option to LOCK or UNLOCK files and if a client attempts to modify a locked resource, this is the error returned by the server.

When a lock is first granted by a server, the Lock-Token response header is sent to the client, usable later to unlock the resource or refresh the lock.

As part of the response, the server includes an appropriate precondition or post-condition code to help guide the client. This might include lock-token-submitted or no-conflicting-lock.

Outside Webdav, some platforms reuse 423 to signal account-level lockouts. The Shopify API returns 423 Locked when a shop is locked due to repeated API rate limit violations or an account issue such as a detected compromise or fraud risk. The shop owner must resolve the issue with Shopify before API access is restored. An outstanding balance instead freezes the shop and produces 402 Payment Required. This usage has no relation to file locking.

Example

The client attempts to upload a file to the target folder. The folder is locked, so the operation is not allowed and the 423 Locked error is returned. In the subsequent request, the client proves it holds the lock by submitting the lock token in the If request header.

The server validates the token against the lock on the folder and lets the upload proceed under the lock. The lock itself stays in place. Releasing it requires a separate UNLOCK request carrying the Lock-Token header.

Initial request

PUT /documents/ HTTP/1.1
Host: www.example.re
Content-Type: application/pdf
Content-Length: 10000

<PDF file transferred>

Initial response

HTTP/1.1 423 Locked
Content-Type: application/xml
Content-Length: 163

<?xml version="1.0" encoding="utf-8" ?>
<d:error xmlns:d="DAV:">
  <d:lock-token-submitted>
    <d:href>/documents/</d:href>
  </d:lock-token-submitted>
</d:error>

Second request, submitting the lock token

PUT /documents/ HTTP/1.1
Host: www.example.re
Content-Type: application/pdf
Content-Length: 10000
If: (<urn:uuid:123…789>)

<PDF file transferred>

Final response

HTTP/1.1 204 No Content

How to fix

Check the response body for the precondition code. A lock-token-submitted error means the request lacked the required lock token. A no-conflicting-lock error means another lock prevents access.

If the lock belongs to the same client session, include the Lock-Token value in an If request header and re-send the request. The server validates the token and allows the modification.

If a different user or process holds the lock, wait for the lock to expire or contact the lock owner. Lock timeouts are configurable on the Webdav server. Review the Timeout header value returned when the lock was originally granted to determine how long the lock persists.

For SharePoint and Office Online environments, files locked by desktop applications remain locked until the application closes or a configurable timeout elapses. An administrator releases stale locks through the SharePoint management interface.

Send an UNLOCK request with the matching Lock-Token to explicitly release a lock. A successful unlock removes only the specified lock. Other locks on the same resource remain active and continue to trigger this error.

On the server side, set reasonable lock timeouts to prevent abandoned locks from blocking other clients indefinitely. The WebDAV specification recommends servers enforce timeout limits rather than granting infinite locks.

For Shopify API consumers, a 423 means the shop itself is locked. Reduce API call rates when repeated rate limit violations caused the lock, or contact Shopify support when the account was flagged for compromise or fraud risk.

Code references

.NET

HttpStatusCode.Locked

Rust

http::StatusCode::LOCKED

Rails

:locked

Go

http.StatusLocked

Symfony

Response::HTTP_LOCKED

Python3.5+

http.HTTPStatus.LOCKED

Apache HttpComponents Core

org.apache.hc.core5.http.HttpStatus.SC_LOCKED

Angular

@angular/common/http/HttpStatusCode.Locked

See also

Last updated: August 11, 2026