The short version
- 01Read the response body for the rejected field, syntax or header.
- 02Reopen the intended page through the site's navigation when a copied URL fails.
- 03Validate the request body against the endpoint's documented format.
- 04Use a URL builder to encode parameter values instead of assembling a URL by hand.
- 05Let the HTTP client manage body-framing headers unless a documented integration requires otherwise.
- 06Retest a corrected minimal request and report persistent failures with redacted details.
Raw message
400 Bad Request
Likely causes
- Malformed request syntax or a body the server cannot parse.
- A URL containing incorrectly encoded characters.
- Conflicting request-framing headers added by a client or intermediary.
- Parameters or body structure that do not match the endpoint's requirements.
A broad rejection needs the response detail
400 identifies a request the server considers invalid. It can involve syntax, message framing or routing; the number alone does not name a broken field. An unchanged retry normally produces the same rejection.
Separate the HTTP status from the application's explanation. An API may return a JSON message identifying a parsing error, while a web server rejects a request before the application runs. Capture that message before making changes.
If you see 400 in a browser
Our first comparison is the site's normal navigation versus the failing link. If navigation works, check the copied address for accidental punctuation or damaged parameter values. Report the broken link to its sender rather than inventing values for a signed or account-specific URL.
If submitting the site's own form produces 400, keep a copy of your unsent text and note the action and visible error. Tell support whether the failure occurs with a simple valid submission too. The code does not, by itself, justify deleting all browsing data or resetting your network.
If you build the request or maintain the service
Compare the endpoint documentation with the actual method, URL, headers and serialized body. Use a JSON serializer rather than string concatenation, and start with the smallest documented request. GitHub, for example, documents 400 for malformed JSON and for sending the wrong top-level body shape; these are separate checks.
Cloudflare documents improperly encoded URL characters and conflicting Content-Length and Transfer-Encoding framing as causes. Prefer the HTTP library's serialization and framing. If an intermediary adds headers, inspect the request at the rejecting layer rather than assuming the application received the same bytes you sent.
Once the body can be parsed, follow any more specific response: 413 concerns size, 415 format support and 422 processing the supplied values. Those distinctions help you change the relevant part of the request.
Sources and review notes
Checked on . Based on MDN, Cloudflare and GitHub documentation. Browser comparisons are editorial diagnostics; application-specific messages determine the precise remedy.