APITester| Status code | 400 |
|---|---|
| Status text | Bad Request |
| Category | 4xx Client Error |
| Response has body | Usually |
| Specification | RFC 9110 |
What does 400 Bad Request mean?
The server could not understand the request because it is malformed. It belongs to the 4xx Client Error class, which means the request contains bad syntax or cannot be fulfilled. Something about the request needs to change.
When do APIs return 400?
Invalid JSON syntax, a missing required field, a wrongly typed value, or a malformed query parameter.
How to fix a 400 Bad Request
Validate your request body as JSON first — a trailing comma or a single quote is the usual culprit. Confirm Content-Type: application/json is set, and read the response body: most APIs explain exactly which field failed.
Reproduce a 400 response
The fastest way to understand a status code is to trigger one and read the full response. Open the
API tester and send a request to https://httpbin.org/status/400 — you will
see the 400 status along with every response header the server sent. Comparing those headers against
a working request is often what reveals the cause.
When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.
Related 4xx status codes
401 Unauthorized
The request lacks valid authentication credentials. Despite the name, this means unauthenticated.
402 Payment Required
The request cannot be processed until payment is made.
403 Forbidden
The server understood the request and knows who you are, but refuses to authorise it.
404 Not Found
The server cannot find the requested resource.
405 Method Not Allowed
The endpoint exists but does not support the HTTP method you used.
406 Not Acceptable
The server cannot produce a response matching the client's Accept header.
400 Bad Request FAQ
What is the difference between 400 and 422?
400 means the server could not understand the request at all, for example malformed JSON. 422 means the request was well formed but its contents failed validation, such as a missing required field.
Why do I get 400 Bad Request with valid JSON?
The usual causes are a missing or wrong Content-Type header, so the server parses the body as something else, a required parameter that is absent, or a value of the wrong type. The response body often names the field.
Can a 400 error be caused by cookies or headers?
Yes. Oversized or corrupted cookies and malformed headers produce a 400 before the application ever sees the request. In a browser, clearing the cookies for the site often fixes it.
See also
- 422 Unprocessable Entity — The syntax is valid but the content fails the server's validation rules.
References
- RFC 9110, 400 Bad Request — The specification that defines this status code.
- MDN: 400 Bad Request — MDN's reference page for this status code.