HTTP Status Codes

400 Bad Request

The server refused the request because it was malformed — bad syntax, invalid framing, or unparseable input. A generic client-error catch-all.

What it means

400 Bad Request signals a client-side error the server cannot or will not process: malformed JSON, an invalid query string, a header the server rejects, or a request that violates protocol framing. The client should not repeat it unchanged.

HTTP RESPONSE
HTTP/1.1 400 Bad Request
Content-Type: application/problem+json

{ "title": "Invalid JSON body", "status": 400 }

Why it matters

  • It tells clients the fault is on their side, so retrying identically will not help.
  • A descriptive body (ideally RFC 7807 problem+json) turns a 400 into an actionable error.

Common mistakes

  • Using 400 for authentication (should be 401) or authorization (should be 403) failures.
  • Returning 400 with no detail, leaving the client to guess what was malformed.

How WebInspect checks this

  • The API Inspector evaluates whether error responses use correct status codes and a structured error format.