400Bad Request

The server could not understand the request well enough to process it, so it refused before trying.

When you see it

A genuine 400 means the request was malformed: broken JSON, a header the server cannot parse, a missing required field, or a value in a shape the endpoint does not accept.

It is also the code most often used as a catch-all. Plenty of APIs answer 400 for anything they do not like, including cases that have more specific codes such as 401, 404 or 422.

What to do about it

Read the response body first: most APIs explain which field was wrong, and that is faster than guessing. Then check the request actually sent rather than the one you meant to send, since a 400 usually comes from a difference between the two.

In a browser, a 400 with no obvious cause is often an oversized or corrupted cookie. Clearing cookies for that site fixes it, and if that works, the server is sending headers larger than it is willing to read back.

Often confused with

422 Unprocessable Content

400 means the server could not parse the request at all. 422 means it parsed fine but the contents failed validation, which is a more useful thing to tell a client.

Look up another one

Open

Type a code, a partial code like 40, or any word from a name or description. Everything runs in your browser.

Filter

Copy format

Status codes

69 of 69 codes. Click a row to copy it.

1xx Informational (4)

2xx Success (10)

3xx Redirection (8)

4xx Client errors (31)

5xx Server errors (16)