400 Bad Request

What 400 means

The catch-all client error: invalid JSON, a missing required field, a malformed header, a URL that is too long, or a cookie the server cannot parse.

Good APIs return a body explaining which field failed. If you see 400 from a proxy such as nginx rather than the application, the request never reached your code; oversized headers and bad Host values are typical.

Common causes

• Invalid or truncated JSON body.
• Missing or wrong Content-Type.
• Oversized cookies or headers (nginx: "Request Header Or Cookie Too Large").
• Malformed query string or URL encoding.

How to fix it

• Validate the request body against the API schema and read the error message in the response body.
• Clear cookies for the site if the browser shows 400 on every page.
• Raise large_client_header_buffers in nginx if legitimate headers exceed the default 8 KB.

What it looks like

A typical response:

HTTP/1.1 400 Bad Request
Content-Type: application/problem+json

{"title":"Invalid request","detail":"body.email must be a valid email"}

The same event in an nginx access log (the status is the number after the request line):

203.0.113.7 - - [10/Sep/2026:10:12:01 +0000] "GET /api/orders HTTP/1.1" 400 153 "-" "Mozilla/5.0"

Check it with curl

-i prints the status line and headers, and -w '%{http_code}' prints only the number, which is handy in scripts and health checks. Replace the URL with yours:

curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://example.com/api/orders

Compare what curl sees with what the browser sees. A different status from the same URL usually means a cache, a CDN edge or a cookie is in the way.

Investigating a run of 400s? Paste the log excerpt into Log Share to get line numbers, highlighting and an expiring link for whoever is on call with you.

Related status codes

• 401Unauthorized: Authentication is required or the credentials sent are invalid.
• 403Forbidden: The server understood the request and refuses to authorise it.
• 404Not Found: The server found no resource at that URL.
• 422Unprocessable Content: The request is syntactically valid but semantically wrong.

FAQ