HTTP 400 Bad Request

What HTTP 400 Bad Request means

400 Bad Request means the server couldn't understand the request because it's malformed — bad JSON, an invalid parameter, or a broken header. It's a catch-all client error: the request has to change before it can succeed.

Which category is it?

400 is a 4xx code — Client error. 4xx means the request has a problem the client must fix — bad syntax, missing authentication, or a resource that isn't there. It's the caller's responsibility.

Common causes

• Malformed JSON or invalid request body
• Missing or invalid query parameters
• A header the server can't parse
• Request size or syntax limits exceeded

How to fix it

• Validate the request body against the API's schema
• Check required parameters and their types
• Inspect the raw request with a tool like the cURL formatter

Example 400 response

POST /api/users HTTP/1.1
Content-Type: application/json

{"name": "Ada",}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"error":"Unexpected token } in JSON at position 16"}

How to diagnose a 400

1. Read the response body. Most APIs explain what they could not parse or which parameter was invalid.
2. Validate the request body as JSON (a trailing comma and unquoted keys are classic causes) and compare it with the API schema.
3. Check the URL: unescaped characters, a malformed query string, or an invalid percent-encoding can trigger 400.
4. Look at headers and size: a duplicated or oversized header (for example a very large Cookie) makes many servers return 400.

400 compared with similar codes

• 422: 422 means the request was well-formed but failed validation. 400 usually means it could not be understood at all.
• 415: 415 means the body format is not supported. 400 means the body was supposed to be supported but is malformed.

400 Bad Request: common questions

What causes a 400 Bad Request in the browser?

Common causes are a corrupt or oversized cookie, a malformed URL, or a bad request header. Clearing site cookies often resolves it.

400 or 422 for validation errors?

Either is used. Many APIs return 400 for any invalid request, others reserve 422 for semantic validation failures.

Other client error (4xx) codes