400 Bad Request
The server refused the request because it was malformed. The client must change something before retrying, because repeating the same bytes will fail identically.
At a glance
- Status code
- 400 Bad Request
- Class
- 4xx, client error, the request itself is the problem
- Defined in
- RFC 9110
- Cacheable by default
- by explicit headers only
- Response body
- Should explain what was wrong with the request.
In detail
400 is the general-purpose client error: bad syntax, a body that does not parse, a header the server cannot make sense of. It says the fault is on the sending side.
Reach for a more specific code first. 401 for missing credentials, 403 for a permission problem, 404 for a missing resource, 422 for a well-formed body that fails validation. 400 is what is left when none of those fit.
Return which field was wrong. A 400 with an empty body forces the client author to guess, and guessing wrong produces a support ticket rather than a fix.
Examples
HTTP/1.1 400 Bad Request
Content-Type: application/problem+json
{"type":"about:blank","title":"Malformed JSON","detail":"Unexpected token at line 3"}Things that catch people out
- Reverse proxies emit 400 for oversized or malformed headers before the application ever sees the request, so the application log will be empty. Check the proxy log.
- A 400 for a business rule violation is misleading. If the JSON parsed and the fields were the right type, 422 says more.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →401 Unauthorized
The request lacks valid credentials. Despite the name, this is about authentication (who you are), not authorisation (what you may do).
422 Unprocessable Content
The request was well-formed and understood, but the values inside it failed validation. The syntax was fine and the semantics were not.
404 Not Found
The server has no representation for this URL and will not say whether it ever did. The most common status code on the web after 200.
402 Payment Required
Reserved for future use in the original specification, and now used in practice by APIs to signal that a plan limit or unpaid invoice is blocking the request.
403 Forbidden
The server understood the request and refuses to fulfil it. Unlike 401, sending different credentials will not help.
405 Method Not Allowed
The URL exists but does not support the method you used. The Allow header lists the methods it does support.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL