4xx Client Error

Client error responses

The request is the problem: malformed, unauthorized, not allowed, or asking for something that is not there.

4xx says the server believes the fault lies with the request. Retrying an identical request usually produces an identical result, with two notable exceptions: 408 and 429, which are about timing rather than content.

This range carries the most operationally important codes for automation. 401 and 407 are authentication, at the origin and at the proxy respectively. 403 and 429 are the standard faces of blocking and rate limiting.

Codes in this class

• 400 Bad Request: The server will not process the request because something about it is malformed.
• 401 Unauthorized: The request lacks valid authentication credentials for the target resource.
• 402 Payment Required: Reserved for future use. In practice, APIs use it to signal a billing problem such as an exhausted quota or an unpaid invoice.
• 403 Forbidden: The server understood the request and refuses to authorize it. Authenticating again will not help.
• 404 Not Found: The server has no representation for the target URL and will not say whether it ever did.
• 405 Method Not Allowed: The URL exists but does not support the HTTP method that was used.
• 406 Not Acceptable: The server cannot produce a response matching the Accept headers on the request.
• 407 Proxy Authentication Required: The proxy between the client and the destination requires credentials before it will forward the request.
• 408 Request Timeout: The server gave up waiting for the client to finish sending the request.
• 409 Conflict: The request conflicts with the current state of the resource, so it cannot be applied as sent.
• 410 Gone: The resource has been permanently removed and no forwarding address exists.
• 411 Length Required: The server refuses the request because it did not declare a Content-Length.
• 412 Precondition Failed: A conditional header on the request evaluated to false, so the server did not perform the method.
• 413 Content Too Large: The request body is larger than the server is willing or able to process.
• 414 URI Too Long: The request target is longer than the server is willing to interpret.
• 415 Unsupported Media Type: The body is in a format the server does not support for this resource and method.
• 416 Range Not Satisfiable: None of the ranges in the Range header overlap the current size of the resource.
• 417 Expectation Failed: The expectation in the request's Expect header cannot be met by the server.
• 418 I'm a Teapot: An April Fools joke from the Hyper Text Coffee Pot Control Protocol, permanently reserved so it can never be reused.
• 419 Page Expired: Laravel's code for a missing or expired CSRF token, most often seen when a form is submitted after the session lapsed.
• 420 Enhance Your Calm / Method Failure: Two unrelated legacy meanings: rate limiting in the old Twitter API, and a failed method in early Spring versions.
• 421 Misdirected Request: The request reached a server that is not configured to produce a response for the requested authority.
• 422 Unprocessable Content: The request is syntactically valid but semantically wrong, so the server cannot act on it.
• 423 Locked: WebDAV code meaning the target resource is locked and the request cannot proceed without the lock token.
• 424 Failed Dependency: The request failed because an earlier request it depended on failed.
• 425 Too Early: The server refuses to process a request sent in TLS 1.3 early data because it might be a replay.
• 426 Upgrade Required: The server refuses the request on the current protocol and names the protocol the client must switch to.
• 428 Precondition Required: The server requires the request to be conditional, so unconditional writes are rejected.
• 429 Too Many Requests: The client has sent too many requests in a given period and is being rate limited.
• 430 Shopify Security Rejection: Shopify's code for a request rejected by its security layer, often too many URLs in a single request.
• 431 Request Header Fields Too Large: The request headers are collectively or individually too large for the server to process.
• 440 Login Time-out: IIS code meaning the client session has expired and the user must sign in again.
• 444 No Response: Internal nginx code that closes the connection without sending any response at all.
• 449 Retry With: IIS code telling the client to retry after supplying additional information the server needs.
• 450 Blocked by Windows Parental Controls: Legacy Windows code indicating that parental control settings blocked access to the page.
• 451 Unavailable For Legal Reasons: Access is denied because of a legal demand, such as a court order or a statutory blocking requirement.
• 460 Client Closed Connection (Load Balancer): AWS load balancer code logged when the client closed the connection before the load balancer could respond.
• 463 X-Forwarded-For Too Long: AWS load balancer code for a request whose X-Forwarded-For header contains more than 30 addresses.
• 464 Incompatible Protocol Versions: AWS load balancer code for a mismatch between the client protocol version and the target group's expected version.
• 494 Request Header Too Large: Internal nginx code for a request whose headers exceeded the configured buffer, logged before a 400 is returned.
• 495 SSL Certificate Error: Internal nginx code for a client certificate that was provided but failed verification.
• 496 SSL Certificate Required: Internal nginx code for a request that omitted a required client certificate.
• 497 HTTP Request Sent to HTTPS Port: Internal nginx code for a plaintext HTTP request that arrived on a port configured for TLS.
• 498 Invalid Token: ArcGIS code for an expired or otherwise invalid authentication token.
• 499 Client Closed Request: nginx logs 499 when the client disconnects before a response is sent. Esri uses the same number for a missing token.