The request is malformed or invalid.
When to use it
Unparseable JSON, missing required fields, wrong types.
Common causes and fixes
Common causes: malformed JSON such as a trailing comma or single-quoted strings, a body that doesn’t match the declared Content-Type, missing required fields, or invalid query parameters. Before blaming the server, look at the exact bytes sent, with curl -v or the request payload in the DevTools Network tab. Most APIs explain the problem in the response body, so read it.
Infrastructure produces 400 too: nginx returns “Request Header Or Cookie Too Large” when cookies overflow large_client_header_buffers, and “The plain HTTP request was sent to HTTPS port” when you use http:// on port 443. Load balancers reject malformed headers or Host values. Clearing the site’s cookies fixes many browser-only 400s. On your own server, keep 400 for unparseable input and use 422 for failed validation.
Client error (4xx)
4xx codes are client errors: the request itself is wrong, unauthorised or points at something that isn’t there. Retrying the same request won’t help.
What it looks like
HTTP/1.1 400 Bad RequestHow to send it
| Node.js / Express | res.status(400).end() |
|---|---|
| Python / Flask | return '', 400 |
| nginx | return 400; |
How to check it
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/