400 Bad Request

What HTTP 400 Bad Request Means

The server cannot process the request due to a client error.

The request has malformed syntax or invalid request message framing.

Common Causes

• Invalid JSON/XML syntax
• Missing required parameters
• Malformed request headers
• Invalid query string

How to Fix It (For Visitors)

• Check the URL for typos
• Contact the site administrator

How to Fix It (For Developers/Admins)

• Validate request syntax
• Check API request format
• Review Content-Type header
• Validate JSON payload

Common 400 Bad Request Messages

• "Request Header Or Cookie Too Large" (nginx) - the cookies or headers exceed the server's buffer. Clear cookies for the site; on the server raise large_client_header_buffers. See also 431.
• "The plain HTTP request was sent to HTTPS port" (nginx) - use https://. See 497.
• "Invalid JSON" / "Unexpected token" - the request body is not valid JSON or does not match the Content-Type header.
• Bad characters in the URL - spaces, quotes, or % signs that are not percent-encoded. Encode query values with encodeURIComponent() or your HTTP library's parameter API.
• "Bad Request - Invalid Hostname" (IIS/HTTP.sys) - the Host header does not match any site binding.

How to Debug a 400

Read the response body first; most APIs explain which field is wrong. Then compare the raw request with what the server expects:

curl -v -X POST https://api.example.com/items \
  -H 'Content-Type: application/json' \
  -d '{"name": "test"}'

Use 400 for malformed requests and 422 when the syntax is valid but the values fail validation.

Returning a 400 Bad Request (Code Examples)

If you build APIs or web apps, here is how to send an HTTP 400 response and how to test for it:

Node.js (Express)

app.get('/resource', (req, res) => {
  res.status(400).json({ error: 'Bad Request' });
});

Python (Flask)

@app.route('/resource')
def resource():
    return jsonify(error='Bad Request'), 400

PHP

<?php
http_response_code(400);
header('Content-Type: application/json');
echo json_encode(['error' => 'Bad Request']);

Check the status with curl

curl -I https://example.com/resource
# Look for: HTTP/1.1 400 Bad Request

Frequently Asked Questions

What does HTTP 400 Bad Request mean?

The request has malformed syntax or invalid request message framing. In short: The server cannot process the request due to a client error.

Is 400 Bad Request a client or server error?

400 is a 4xx client-error code, so the request itself needs to change. The server is running normally and is rejecting the request as it was sent by the browser, app, or API client.

How do I fix a 400 Bad Request error?

Validate request syntax. Check API request format. Review Content-Type header.

Official Specification

The 400 Bad Request status code is defined in RFC 9110 Section 15.5.1.

View the IANA HTTP Status Code Registry →