The client did something wrong. But beware — a sudden spike in 4xx is often a client-integration bug or an attacker, which IS your problem to investigate.
400 Bad Request
Meaning: Malformed request. Bad JSON, missing required fields, invalid headers. What to check:
- Application logs — what specifically rejected the request
- Did a client deploy recently? (probe their changelog)
- Is the API contract documented and still accurate?
401 Unauthorized
Meaning: No authentication, or authentication failed. "You haven't proved who you are." What to check:
- Missing or expired token (JWT, OAuth, API key)
- Wrong token format (Bearer prefix, header name)
- Clock skew between client and server (signed tokens are time-sensitive)
- Auth provider down (Auth0, Cognito, Entra ID) — check their status page
- TLS handshake succeeding? Sometimes auth fails because mTLS cert chain broke
403 Forbidden
Meaning: Authenticated, but not allowed. "I know who you are, but you can't do this." What to check:
- IAM/RBAC policy on the resource
- Bucket policy if S3 (most common cause of S3 403)
- KMS key policy if encrypted (you can have S3 permissions but lack KMS permissions)
- VPC endpoint policy if accessing via private endpoint
- Cross-account: trust policy + permissions both required
- WAF rules — Cloudflare or AWS WAF can return 403 for matched rules
S3 403 troubleshooting flow:
- IAM policy of the caller
- Bucket policy
- Block Public Access settings
- KMS key policy (if SSE-KMS)
- VPC endpoint policy (if applicable)
- ACLs (legacy, mostly disabled now)
- CloudTrail event will name the specific cause
404 Not Found
Meaning: Resource doesn't exist at that URL. What to check:
- Routing config (Ingress, ALB listener rules, load balancer path patterns)
- Did someone delete the resource (S3 object, DB record)?
- Is the path correct? (case sensitivity, trailing slashes)
- DNS pointing to the right service?
- Reverse proxy stripping or rewriting paths incorrectly
404 nuance: Some APIs return 404 instead of 403 to avoid leaking resource existence to unauthorised users. Worth knowing for security-conscious systems.
405 Method Not Allowed
Meaning: The endpoint exists, but the HTTP method (GET, POST, PUT, DELETE) isn't supported. What to check:
- API was updated — methods changed
- CORS preflight (OPTIONS) being rejected by the server
- Load balancer dropping methods (uncommon but possible)
408 Request Timeout
Meaning: Server gave up waiting for the request to arrive. What to check:
- Slow client uploads (large files, weak network)
- Load balancer idle timeout shorter than client connection
- Mobile clients with unstable networks
409 Conflict
Meaning: Request conflicts with current state. Usually optimistic locking. What to check:
- Concurrent updates to the same resource
- ETags or version fields mismatched
- Duplicate creation attempts (idempotency keys)
413 Payload Too Large
Meaning: Request body exceeds server-side limit. What to check:
- Nginx
client_max_body_size - ALB max request size (1MB for ALB targets, configurable for Lambda integration)
- API Gateway payload limits (10MB)
- Application framework limits (Express, Flask, Spring)
429 Too Many Requests
Meaning: Rate limited. What to check:
- API rate limit settings (Cloudflare, AWS WAF, application-level)
- Misbehaving client looping
- DDoS or scraping attempt (check source IPs)
- Legitimate traffic spike — capacity vs limit tuning
Always include Retry-After header in 429 responses if you're the server.