Bad Request

Overview

400 Bad Request is a generic client error meaning the request is malformed and the server cannot process it — broken body syntax, invalid framing, or failed basic validation.

The most common causes are malformed JSON, missing required parameters, and a mismatched Content-Type. It means the server could not understand the request at the syntax level, which is a different layer from authentication (401) or authorization (403).

When it happens

• It is returned when the body is not valid JSON, a required query parameter is missing, or the header framing is wrong.
• It also occurs when the Content-Type does not match the actual payload, or corrupted cookies/headers prevent the server from parsing the request.

Request / Response example

POST /api/users HTTP/1.1
Host: api.example.com
Content-Type: application/json

{"name": "Ada", }

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"error":"Malformed JSON","detail":"Unexpected token '}' at position 15"}

In code

app.post('/api/users', (req, res) => {
  if (!req.body || typeof req.body.name !== 'string')
    return res.status(400).json({ error: 'name is required' });
  // ...
});

from flask import abort, request
@app.post('/api/users')
def create():
    if not request.is_json:
        abort(400, 'expected application/json')
    return {}, 201

Notes

• When field formats are valid but the meaning (a business rule) is wrong, 422 Unprocessable Content is more accurate than 400.
• If it recurs in a browser, a stale session cookie may be the cause, so try clearing that domain's cookies.
• To aid debugging, include specifics in the response body about which field is wrong and why.

Related status codes

Related headers

Specification