# malformed

A parameter or body could not be read, or a parameter was repeated (400).

## Meaning

Written before the handler runs: a query or path parameter that does not parse into
its type (for example a non-integer `max_age`), a body that is not the document its
media type promises (invalid JSON, or a member the schema does not allow), or a
query or form parameter sent more than once (RFC 6749 §3.1), which is refused rather
than resolved to one of its copies. OAuth endpoints, the authorization endpoint
included, answer it as a problem document too, not an OAuth error object or a
redirect.

## Impact

The request did nothing. It is a bug in the client or in something rewriting the
request; it is not expected from the hosted UI or a conforming client.

## Diagnosis

1. Read `detail`; it names the parameter that did not parse or was repeated.
2. The refusal is recorded as `http.request.screened` with reason `invalid_request`
   and cause `body_malformed` or `parameter_repeated`, under the request id.

## Mitigation

- As a client developer: send each query and form parameter once (an array
  parameter is one comma-separated value), valid JSON with only the
  documented members, and parameters of the documented type. Do not retry unchanged.

## Escalation

Escalate when a request that follows the API reference is refused. Open an issue with
the request id, the endpoint, the request with secrets removed, and the server
version.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.