# invalid_request

> The request can't be read

- Status: 400 Bad Request
- Returned by: The account connection (/oauth)
- Retry (`retryWhen`): `after_fix`
- Did anything happen? (`outcome`): `none` (It did not happen)
- The account connection
- Page in the portal: https://developers.rivr.io/errors/invalid_request
- Try it: `GET https://developers.rivr.io/errors/simulate/invalid_request` answers with the code's exact wire form; `?succeedAfter=N&attempt=K` gives a 200 once `attempt` passes `N`

## What it means

A parameter is missing, wrong or appears twice. On `POST /oauth/token` and `POST /oauth/deauthorize` it can also be a body that isn't form-encoded, or a client authenticating in two ways. On `GET /oauth/authorize` the browser comes back to your address with `?error=invalid_request&state=…` when `response_type`, `state` or PKCE is wrong, and stays on Rivr's error page when `state` is missing or longer than 512 characters or when a parameter appears twice. The sandbox's approval answers with `{"code":"invalid_request"}`.

## What your system does

Fix the request. `/oauth/token` and `/oauth/deauthorize` take `application/x-www-form-urlencoded` only, and the code exchange needs `code`, `redirect_uri` and `code_verifier`. `/oauth/authorize` needs `state` with 32 to 512 characters from `A-Z a-z 0-9 . _ ~ -`, and `code_challenge` with `code_challenge_method=S256`.

## Is it worth retrying?

No, not without changing the call.

`retryWhen`: `after_fix`. Change the request first, as the code's page says: a value, the token, a header or a new key. Then send it.

## Did anything happen?

`outcome`: `none`. **It did not happen.** This call did not do what you asked for and changed nothing else that you can see or that concerns money. Where the code has an `outcomeNote`, it takes precedence.

## Example: The account connection (/oauth)

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json
Cache-Control: no-store

{
  "error": "invalid_request",
  "error_description": "code, redirect_uri and code_verifier are required."
}
```

The `title`, `detail`, `message` and `error_description` texts are exactly as the API writes them today.