INVALID_REQUEST — 400 Bad Request
400 Bad Request
The request body or parameters are invalid. Check the errorCode and errors fields for details.
Categories
This status code may appear with several error categories depending on the domain error:
| Category | Error Codes | What To Do |
|---|---|---|
validation | CATALOGSET_REQUIRED, CARD_NOT_ENCRYPTED, MISSING_STORE_ID, MISSING_CUSTOMER, MISSING_DELIVERY_ADDRESS, MISSING_ADDRESS_FIELD, MISSING_PAYMENT_ID, MISSING_PARTNER_USER_ID, MISSING_IDEMPOTENCY_KEY, SESSION_REQUIRED, INCOMPLETE_IDENTITY | Fix the request based on the error code and retry |
validation | CLIENT_CONTEXT_REQUIRED, CLIENT_IP_INVALID, CLIENT_USER_AGENT_INVALID | Supply valid end-user client context |
payment | PAYMENT_TOKEN_INVALID | Re-vault the card and quote the new token |
Retryable?
No. The request itself must be corrected.
Payment declines do not appear here at all — they are errors[].code reasons on an HTTP 200 order, not 400s. See Order lifecycle → Error codes.
Error Codes
Each code below is an anchor. The type URI on a problem-detail response points straight at it, so
dereferencing type lands on the exact code rather than the top of this page.
MISSING_STORE_ID
The request did not name a store.
What to do: Supply cart.storeId.
MISSING_CUSTOMER
The request carried no customer object.
What to do: Supply customer.
MISSING_PARTNER_USER_ID
customer.partnerUserId is required to vault a card or place an order.
What to do: Supply your own stable identifier for the end user.
INCOMPLETE_IDENTITY
Session identity is atomic: supply nothing (anonymous), or all of partnerUserId, email, firstName, lastName together.
What to do: Send the full identity set, or none of it.
MISSING_ADDRESS_FIELD
A delivery address was supplied with a required component missing.
What to do: Complete the address and resubmit.
MISSING_IDEMPOTENCY_KEY
placeOrder requires an Idempotency-Key header.
What to do: Generate a fresh UUID v4 per order attempt and send it.
MISSING_DELIVERY_ADDRESS
A delivery order was submitted without an address.
What to do: Supply the delivery address, or switch the fulfillment mode to pickup.
CARD_NOT_ENCRYPTED
Card fields reached us as cleartext rather than Evervault ciphertext.
What to do: Encrypt card fields in the browser before sending. This is the control that keeps raw PANs off our origin.
MISSING_PAYMENT_ID
The order named no payment method.
What to do: Vault a card first, then send its paymentId.
SESSION_REQUIRED
The endpoint requires a session and none was presented.
What to do: Create a session first.
INVALID_GOOGLE_TOKEN
The supplied Google identity token could not be validated.
What to do: Re-run the Google sign-in flow to obtain a fresh token.
IDENTITY_IMMUTABLE
Session identity fields cannot be changed once set.
What to do: Start a new session rather than mutating an identified one.
INVALID_STORE_ID
The store identifier was not a well-formed id.
What to do: Supply a canonical store id as returned by discovery.
INVALID_CATALOGSET_ID
The catalog-set identifier was not a well-formed id.
What to do: Use the catalogSetId returned with the store.
Example
Code