307 whenever the request might not be a GET, because it guarantees the method and body survive. 302 is permitted - and in practice near-universally does - convert a POST to a GET, losing the body.

Both preserve the method. 307 is temporary, so clients keep using the original URL; 308 is permanent, so they update their references and it is cached aggressively.

307 Temporary Redirect

Temporarily at a different URL, and the method and body must be preserved.

Class 3xx · Redirection
Retry Safe to retry

What 307 means

307 was introduced precisely to remove the ambiguity in 302. It is temporary, like 302, but it explicitly forbids the client from changing the request method, so a POST followed to the new URL remains a POST with its body intact.

That makes it the correct temporary redirect for any API where requests are not all GETs. The classic failure it prevents is a POST redirected with 302, arriving at the destination as a bodyless GET, which looks like the client sent an empty request.

It is also what HSTS uses internally and what you want for temporarily routing traffic to a different backend without breaking non-GET requests.

Headers this status expects

Location - the temporary URL. Required.

Should a client retry?

Follow the redirect with the same method and body. Do not treat it as permanent.

FAQ

307 or 302?: 307 whenever the request might not be a GET, because it guarantees the method and body survive. 302 is permitted - and in practice near-universally does - convert a POST to a GET, losing the body.
307 or 308?: Both preserve the method. 307 is temporary, so clients keep using the original URL; 308 is permanent, so they update their references and it is cached aggressively.

Often confused with

302 Found The resource is temporarily at a different URL.
308 Permanent Redirect Permanently moved, and the method and body must be preserved.