Locked

Description

Examples

PUT /webdav/reports/Q4-financials.docx HTTP/1.1
Host: dav.example.com
Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document
Authorization: Bearer user-alice-token

<binary document content>

HTTP/1.1 423 Locked
Content-Type: application/xml; charset=utf-8

<?xml version="1.0" encoding="utf-8"?>
<D:error xmlns:D="DAV:">
  <D:lock-token-submitted>
    <D:href>/webdav/reports/Q4-financials.docx</D:href>
  </D:lock-token-submitted>
</D:error>

LOCK /webdav/reports/Q4-financials.docx HTTP/1.1
Host: dav.example.com
Authorization: Bearer user-bob-token
Content-Type: application/xml; charset=utf-8
Timeout: Second-3600

<?xml version="1.0" encoding="utf-8"?>
<D:lockinfo xmlns:D="DAV:">
  <D:lockscope><D:exclusive/></D:lockscope>
  <D:locktype><D:write/></D:locktype>
  <D:owner>
    <D:href>mailto:[email protected]</D:href>
  </D:owner>
</D:lockinfo>

HTTP/1.1 200 OK
Lock-Token: <urn:uuid:e71d4fae-5dec-22d6-fea5-00a0c91e6be4>
Content-Type: application/xml; charset=utf-8

<?xml version="1.0" encoding="utf-8"?>
<D:prop xmlns:D="DAV:">
  <D:lockdiscovery>
    <D:activelock>
      <D:lockscope><D:exclusive/></D:lockscope>
      <D:locktype><D:write/></D:locktype>
      <D:depth>infinity</D:depth>
      <D:owner><D:href>mailto:[email protected]</D:href></D:owner>
      <D:timeout>Second-3600</D:timeout>
      <D:locktoken>
        <D:href>urn:uuid:e71d4fae-5dec-22d6-fea5-00a0c91e6be4</D:href>
      </D:locktoken>
    </D:activelock>
  </D:lockdiscovery>
</D:prop>

PATCH /api/invoices/inv_8xKq2mN HTTP/1.1
Host: api.example.com
Content-Type: application/json
Authorization: Bearer api-key-123 
{"status": "void"}

HTTP/1.1 423 Locked
Content-Type: application/json
Retry-After: 30

{"error": "resource_locked", "message": "Invoice inv_8xKq2mN is currently being processed by a payment reconciliation job. Try again after the job completes.", "locked_by": "job/reconcile_batch_20240115", "lock_acquired_at": "2024-01-15T10:45:00Z", "lock_expires_at": "2024-01-15T10:50:00Z", "retry_after_seconds": 30}

UNLOCK /webdav/reports/Q4-financials.docx HTTP/1.1
Host: dav.example.com
Authorization: Bearer user-bob-token
Lock-Token: <urn:uuid:e71d4fae-5dec-22d6-fea5-00a0c91e6be4>

Edge Cases

• •423 requires a lock MECHANISM — if the server just doesn't want to process the request due to general state conflict without a formal lock, use 409 Conflict instead.
• •Lock tokens MUST be submitted in the If header (not Lock-Token) when modifying a locked resource you own: `If: (<urn:uuid:token>)`. The Lock-Token header is only for UNLOCK requests.
• •Depth:infinity locks on collections lock ALL descendants. A 423 on a child resource may be caused by a lock on a parent collection — include the lock root in the response.
• •Lock timeouts are advisory, not guaranteed. Servers MAY revoke locks before timeout expiry due to administrative action or resource pressure. Clients must handle unexpected lock loss.
• •Shared locks allow multiple lock holders for read access, but a write attempt by any holder still returns 423 if another shared-lock holder hasn't released. Shared does NOT mean concurrent writes.
• •Some REST APIs return 423 with a Retry-After header to indicate when the lock will expire — this is non-standard (RFC 4918 doesn't define Retry-After for 423) but pragmatically useful.
• •Lock-null resources: WebDAV allows locking a URL that doesn't exist yet (to reserve it for creation). A 423 can occur on a resource that appears to not exist from a GET perspective.

When You'll See This

• →Another user has an exclusive write lock on a shared document in SharePoint or Nextcloud
• →CalDAV server rejects a calendar event update because another client holds the lock
• →Background job holds a pessimistic lock on a database entity during batch processing
• →Attempting to delete a file in a WebDAV collection that has a depth:infinity lock from a parent
• →Collaborative editing tool prevents concurrent modifications to the same section
• →CI/CD pipeline locks a deployment resource during an active rollout
• →API resource is temporarily locked during a multi-step saga/transaction that requires exclusive access

Implementation References

History

Introduced in RFC 2518 (1999) as part of the original WebDAV specification. Updated and refined in RFC 4918 (2007), which clarified lock semantics, lock-null resources, and error reporting. WebDAV itself was motivated by the need for collaborative authoring over HTTP — a group at UC Irvine and Xerox PARC wanted to make the web a writable medium, not just readable. The 423 status code filled a gap that HTTP's conditional headers (If-Match, If-Unmodified-Since) couldn't address: explicit, time-bounded, identity-aware locking with tokens. While WebDAV never achieved universal adoption for general web authoring, it became the backbone of enterprise file systems (SharePoint, Nextcloud), calendar/contact sync (CalDAV, CardDAV), and collaborative editing platforms. The 423 code has been adopted outside WebDAV by APIs that implement pessimistic locking semantics, though it remains registered in the IANA HTTP Status Code Registry under WebDAV.

Related Status Codes

Related Headers

FAQ