4xx Client Error
400 Bad Request
The server refuses to process the request because it is malformed.
What causes it
- Invalid JSON in the body — a trailing comma or a truncated payload.
- A header that is too large, or contains an illegal character.
- A query string with an invalid percent-encoding, such as a bare `%`.
- A missing required parameter, where the API chose 400 over 422.
How to fix it
- Log the raw body server-side and validate it — most 400s are a serialisation bug on the client.
- If the request works with curl but not from a browser, compare the exact headers; a stray cookie or oversized `Authorization` header is a common culprit.
- nginx returns 400 for oversized request headers before your application ever sees them; raise `large_client_header_buffers` if that is the cause.
At a glance
- Class
- 4xx Client Error
- Reference
- RFC 9110 §15.5.1
- Standardised
- Yes
- Retry the request?
- No — fix the request
Other 4xx client error codes
- 401 Unauthorized
- 402 Payment Required
- 403 Forbidden
- 404 Not Found
- 405 Method Not Allowed
- 406 Not Acceptable
- 407 Proxy Authentication Required
- 408 Request Timeout
- 409 Conflict
- 410 Gone
- 411 Length Required
- 412 Precondition Failed
- 413 Content Too Large
- 414 URI Too Long
- 415 Unsupported Media Type
- 416 Range Not Satisfiable
- 417 Expectation Failed
- 418 I'm a teapot
- 421 Misdirected Request
- 422 Unprocessable Content
- 423 Locked
- 424 Failed Dependency
- 425 Too Early
- 426 Upgrade Required
- 428 Precondition Required
- 429 Too Many Requests
- 431 Request Header Fields Too Large
- 451 Unavailable For Legal Reasons
- 499 Client Closed Request