400 Bad Request — What It Means and How to Fix It

What 400 means

The server received your request but could not parse it. Something about the syntax is wrong — not the destination, not your permissions, the request itself. This is the generic client-error catch-all, which makes it one of the less informative codes to receive.

Common causes

•Malformed JSON in a request body — a trailing comma or unquoted key is enough.
•A header that is too large, most often a bloated cookie after many redirects.
•Invalid characters in the URL or query string that were never percent-encoded.
•A required parameter missing or supplied in the wrong type.
•A mismatched Content-Type — sending JSON while declaring form data, or the reverse.

How to fix it

Reproduce the request with curl and inspect exactly what is being sent, rather than what you believe is being sent. Validate any JSON body independently. If it only happens for some users, suspect oversized cookies and try in a private window — that isolates it immediately.

Catching 400 before your users report it

A 400 from your own API in a monitor usually means the monitor is misconfigured rather than the service being down. Check the request body and headers on the monitor before assuming a real fault.

Monitor for 400 responses free

Often confused with

401 Unauthorized 403 Forbidden

← All HTTP status codes

400 Bad Request — questions

Is a 400 error my fault or the server's?

By definition it is attributed to the client — the server is saying it could not parse what it received. In practice the cause is often a server-side validation rule that is stricter than documented, so it is worth checking both sides.

How do I fix a 400 error as a website visitor?

Clear the site's cookies and try again. Oversized or corrupted cookies are the most common cause a visitor can actually resolve. Loading the page in a private window is the quickest way to confirm that is the problem.

400