ErrLookup › Background articles › BAD_REQUEST error code: request rejected as invalid (HTTP 400) - causes and fixes across libraries

BAD_REQUEST error code: request rejected as invalid (HTTP 400) - causes and fixes across libraries

BAD_REQUEST is the error code libraries use for HTTP 400 semantics: the request is malformed, fails validation, or violates a precondition, and the server refuses it before doing any real work. Developers meet it as a tRPC TRPCError in applications like LobeChat and Reactive Resume, as HTTP 400 from Harbor's policy and configuration checks, as Astro's AstroActionInputError carrying serialized Zod issues back to the browser, and as Sentinel's cluster-transport rejection of a malformed request. This article explains the mechanism behind the family, the causes that recur across libraries, and the remediation themes that hold everywhere.

Distilled from 88 documented records across 8 repositories.

Background

BAD_REQUEST carries HTTP 400 semantics into a library's own error system: the request is invalid on arrival, and the receiving code refuses to process it further. In tRPC-based applications such as LobeChat and Reactive Resume it is a TRPCError with code 'BAD_REQUEST', thrown deliberately by a validation guard at the top of a procedure before any side effects run. In Harbor it is the HTTP 400 returned when a schema or rule check rejects a preheat policy, configuration update, replication rule, or artifact request. In Astro, when a server action's Zod validation fails, the server serializes its issues and the client re-throws them as an AstroActionInputError with code 'BAD_REQUEST'. Sentinel's cluster transport and tRPC's HTTP adapter sit at the same boundary from the other side: a malformed request object or request line is rejected before application logic ever sees it. The family exists to separate caller bugs from server faults; the code is the server saying the problem is in what was sent, not in how it was processed.

From the caller's side the family behaves consistently. The failure is synchronous and deterministic, so retrying the identical request fails identically; this is not a transient condition. The message usually carries the evidence needed for a fix: Astro embeds the JSON array of Zod issues and groups messages by field in error.fields; Harbor formats the offending value into the message, whether the cron string that failed to parse, the repository path too shallow for the configured flattening level, or the content type sniffed from an icon layer; LobeChat passes an embedding provider's business reason through verbatim, and its bot-settings validator surfaces whichever field violated the access policy. A bare message such as Sentinel's 'bad request' for a null or untyped ClusterRequest means the library found the request internally inconsistent, and the caller must inspect the code that built it.

What varies across the family is the layer that rejects. Some records are pure input-shape validation: a negative file size in LobeChat, a date outside strict YYYY-MM-DD in Reactive Resume, a fallback fingerprint that is not 64-character lowercase hex. Others are business-rule preconditions: LobeChat refuses an agent or chat group whose visibility conflicts with the target folder, and Harbor rejects a replication rule whose flattening level exceeds the source repository's path depth, or an LDAP group update whose merged effective configuration leaves the name attribute empty. Some are security and trust-boundary guards: open-design's importer refuses repositories containing symbolic links to prevent file exfiltration, and Harbor sniffs artifact icon layers and accepts only GIF, PNG, or JPEG. A few encode state mismatches, such as Reactive Resume refusing an answer whose toolCallId matches no unanswered question. Classification is library-specific: LobeChat reports a missing operation ID as BAD_REQUEST rather than a 404, and an embedding provider's business error surfaces as BAD_REQUEST rather than a server error, so do not infer fault or retry semantics from the code alone.

Common causes

What usually fixes it

Go deeper

Documented occurrences

…and 68 more across the corpus — use search.

Honest provenance: generated on 2026-08-24 from AI-assisted analysis of the linked records. See how records are made.