Automation Answers

Why Is My Webhook Returning a 400 Bad Request?

An API or webhook call returns 400 Bad Request when the JSON is malformed, the content type is wrong, a required field is missing, or a value is the wrong type.

By Automation Ace Editorial Team · Reviewed for technical accuracy by Troy Tessalone · Published · Updated

Short answer

Why Is My Webhook Returning a 400 Bad Request?

A 400 Bad Request means the server received your request but couldn't accept its contents. Usually the JSON is malformed, the Content-Type header doesn't match the body, a required field is missing, or a value has the wrong type or format. Read the error body, compare the exact request with the API's documented example, and fix one field at a time, starting from a minimal valid request.

Common causes

  • A mapped value contains a quote, line break, or backslash that breaks a hand-written JSON body.
  • The request is sent as form data while the API expects JSON, or the Content-Type header is missing.
  • A required field is missing, or a mapped field is blank in this run.
  • A value has the wrong type or format, such as a number sent as text, a date in the wrong format, or an option the API doesn't allow.
  • Nested objects or arrays are flattened or sent as a single string.

Diagnostic steps

  1. Read the full response body. Most APIs name the field or problem.
  2. Copy the exact request body from the run history and check it with a JSON validator.
  3. Send the API's documented example request first, then add your mapped fields one at a time.
  4. Set the Content-Type header and payload type to match what the API expects, usually application/json.
  5. Build JSON in a Code step with JSON.stringify() instead of typing it by hand, so special characters are escaped.

Example

A Webhooks by Zapier POST works in testing but fails with 400 for some records. The raw JSON body includes "notes": "{{notes}}", and those records' notes contain double quotes. Building the body in a Code step with JSON.stringify() escapes the quotes and fixes the error.

Caveats

Some APIs use 422 for valid JSON that fails their validation rules, and treat it much like a 400. Don't retry a 400 automatically, because the same request will fail again until it is fixed.