Checkcraft400 Bad Request in an API: what is wrong with the request
A 400 means the server refused to process the request because it considers it invalid. The cause is almost always in the request itself, and you can find it without server access.
What a 400 means
The server got the request but cannot or will not process it: the syntax is broken, required fields are missing, or a value has the wrong type or format. Some APIs use 422 Unprocessable Content for invalid values and keep 400 for unreadable requests, but many answer 400 in both cases. Repeating the same request unchanged will not help.
How to find the cause
Read the response body first: a good API names the field and the rule, for example “amount must be positive”. Then run the JSON through a validator: a trailing comma or single quotes cause a 400 before any field is checked. Make sure Content-Type: application/json is sent, otherwise the server cannot read the body. Compare the fields with the documentation: a string instead of a number, a date in the wrong format, a missing required field. Spaces and non-Latin characters in the URL must be encoded.
curl -i -X POST https://api.example.com/orders \
-H "Content-Type: application/json" \
--data-binary "@order.json"A 400 from nginx and in the browser
“400 Bad Request: Request Header Or Cookie Too Large” means the headers or cookies exceed the server limit; clearing this site’s cookies helps. “The plain HTTP request was sent to HTTPS port” means a plain HTTP request went to a port that expects HTTPS: the address needs https://. In both cases the request never reaches the application, so its logs will show nothing.
A 400 as the expected test result
For invalid data a 400 is the correct answer and worth checking on its own: the status, an error text naming the field, and that the server created nothing. A 200 or 500 for invalid data is a service bug. In Checkcraft such negative scenarios are rules on the status code and error fields, with no code.
Repeat this on your own API
Checkcraft is a desktop app that saves API response checks without code and shows what did not match. Start with a sample, then use your own sanitized data. Free runs on Windows and Linux with no time limit.
Download FreeDownload and first runNo sign-up or email needed, the archive is ready in a couple of minutes. See the edition limits.
References
Start with the linked example and compare its result with your own test requirement.