# INVALID_REQUEST — 400 Bad Request

# 400 Bad Request

The request body or parameters are invalid. Check the `errorCode` and `errors` fields for details.

## Categories

This status code may appear with several error categories depending on the domain error:

| Category | Error Codes | What To Do |
|---|---|---|
| `validation` | [`CATALOGSET_REQUIRED`](/errors/CATALOGSET_REQUIRED), `CARD_NOT_ENCRYPTED`, `MISSING_STORE_ID`, `MISSING_CUSTOMER`, `MISSING_DELIVERY_ADDRESS`, `MISSING_ADDRESS_FIELD`, `MISSING_PAYMENT_ID`, `MISSING_PARTNER_USER_ID`, `MISSING_IDEMPOTENCY_KEY`, `SESSION_REQUIRED`, `INCOMPLETE_IDENTITY` | Fix the request based on the error code and retry |
| `validation` | [`CLIENT_CONTEXT_REQUIRED`](/errors/CLIENT_CONTEXT_REQUIRED), [`CLIENT_IP_INVALID`](/errors/CLIENT_IP_INVALID), [`CLIENT_USER_AGENT_INVALID`](/errors/CLIENT_USER_AGENT_INVALID) | Supply valid end-user client context |
| `payment` | [`PAYMENT_TOKEN_INVALID`](/errors/PAYMENT_TOKEN_INVALID) | Re-vault the card and quote the new token |

## Retryable?

**No.** The request itself must be corrected.

Payment *declines* do not appear here at all — they are `errors[].code` reasons on an HTTP `200` order, not 400s. See [Order lifecycle → Error codes](/distribution-partners/marketfront-api/guides/order-lifecycle#error-codes).


## Error Codes

Each code below is an anchor. The `type` URI on a problem-detail response points straight at it, so
dereferencing `type` lands on the exact code rather than the top of this page.

### MISSING_STORE_ID

The request did not name a store.

**What to do:** Supply `cart.storeId`.

### MISSING_CUSTOMER

The request carried no customer object.

**What to do:** Supply `customer`.

### MISSING_PARTNER_USER_ID

`customer.partnerUserId` is required to vault a card or place an order.

**What to do:** Supply your own stable identifier for the end user.

### INCOMPLETE_IDENTITY

Session identity is atomic: supply nothing (anonymous), or all of `partnerUserId`, `email`, `firstName`, `lastName` together.

**What to do:** Send the full identity set, or none of it.

### MISSING_ADDRESS_FIELD

A delivery address was supplied with a required component missing.

**What to do:** Complete the address and resubmit.

### MISSING_IDEMPOTENCY_KEY

`placeOrder` requires an `Idempotency-Key` header.

**What to do:** Generate a fresh UUID v4 per order attempt and send it.

### MISSING_DELIVERY_ADDRESS

A delivery order was submitted without an address.

**What to do:** Supply the delivery address, or switch the fulfillment mode to pickup.

### CARD_NOT_ENCRYPTED

Card fields reached us as cleartext rather than Evervault ciphertext.

**What to do:** Encrypt card fields in the browser before sending. This is the control that keeps raw PANs off our origin.

### MISSING_PAYMENT_ID

The order named no payment method.

**What to do:** Vault a card first, then send its `paymentId`.

### SESSION_REQUIRED

The endpoint requires a session and none was presented.

**What to do:** Create a session first.

### INVALID_GOOGLE_TOKEN

The supplied Google identity token could not be validated.

**What to do:** Re-run the Google sign-in flow to obtain a fresh token.

### IDENTITY_IMMUTABLE

Session identity fields cannot be changed once set.

**What to do:** Start a new session rather than mutating an identified one.

### INVALID_STORE_ID

The store identifier was not a well-formed id.

**What to do:** Supply a canonical store id as returned by discovery.

### INVALID_CATALOGSET_ID

The catalog-set identifier was not a well-formed id.

**What to do:** Use the `catalogSetId` returned with the store.

## Example

```json
{
  "type": "https://developer.gett-tech.com/errors/CATALOGSET_REQUIRED",
  "title": "Bad request",
  "status": 400,
  "detail": "Cart creation requires a catalogSetId.",
  "instance": "/v1/marketfront/orders/validate",
  "requestId": "req_abc123",
  "timestamp": "2026-03-11T14:30:00.000Z",
  "errorCode": "CATALOGSET_REQUIRED",
  "errorCategory": "validation",
  "retryable": false
}
```