428 Precondition Required
The server requires the request to be conditional, and refuses an unconditional one to prevent a lost update.
At a glance
- Status code
- 428 Precondition Required
- Class
- 4xx, client error, the request itself is the problem
- Defined in
- RFC 6585
- Cacheable by default
- no
- Response body
- Should explain which precondition is required.
In detail
Without If-Match, two clients that both read version one and both write will silently clobber each other. 428 forces the client to declare which version it saw.
Worth enforcing on any resource where concurrent edits are realistic. It converts a silent data loss bug into a visible error.
Send If-Match with the ETag from your last GET. If it no longer matches you get 412, which is the outcome you wanted.
Examples
HTTP/1.1 428 Precondition Required
Content-Type: application/json
{"error":"If-Match header required"}Things that catch people out
- Enforcing 428 on an existing API is a breaking change for every client that was not sending the header.
- It is pointless without stable ETags. If the ETag changes on every response the client can never satisfy the precondition.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →412 Precondition Failed
A conditional header on the request, such as If-Match or If-Unmodified-Since, evaluated to false, so the server did not perform the action.
409 Conflict
The request clashes with the current state of the resource, for example an edit based on a version that has since changed.
304 Not Modified
The cached copy the client already holds is still current, so the server sent no body. This is what makes conditional requests cheap.
429 Too Many Requests
The client has sent too many requests in a given period. The Retry-After header says how long to wait before trying again.
431 Request Header Fields Too Large
The request headers are collectively or individually too large. Oversized cookies are the usual cause.
451 Unavailable For Legal Reasons
Access is denied because of a legal demand, such as a court order or a government blocking request.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL