ValidateThis

API returned an empty or malformed response (HTTP 200)

An API error saying the API returned an empty or malformed response with HTTP 200 means the status code claims success but the body is empty, truncated, or not valid JSON. A proxy or gateway intercepting the request is the most common cause.

HTTP 200 only means the last hop answered successfully. If a proxy, CDN, load balancer, or corporate gateway sits between your client and the API, it can replace the real response with its own page — an HTML login screen, a block page, or an empty body — while keeping status 200.

The parser error appears on your side (“empty or malformed response”), but the root cause is usually in transit or on the server, not in your client code.

Common causes

  • A reverse proxy, CDN, or corporate gateway intercepts the request and returns its own page (often HTML) with status 200.
  • The upstream service crashed or timed out mid-response, so the body is empty or truncated while the proxy still reports 200.
  • Wrong Content-Type: the server sends HTML (login page, error page, captcha) where the client expects JSON.
  • Response compression or chunked-transfer issues corrupt the body in transit.
  • The endpoint returns 200 with an empty body by design, but the client insists on parsing JSON.

How to narrow it down

  • Reproduce with curl -i (or Postman) and look at the raw body and Content-Type header. HTML starting with <!DOCTYPE html> where you expect JSON is the classic proxy-interception signature.
  • Try the same call from another network (mobile hotspot instead of office VPN). If it works there, a corporate proxy or firewall is rewriting responses.
  • Check response length: Content-Length: 0 with status 200 means the server returned success with no body — the bug is in the API handler.
  • Log the first 200 characters of every failed response body; the fragment usually identifies which layer produced it.

Examples

Proxy-intercepted response (HTML with status 200)
HTTP/1.1 200 OK
Content-Type: text/html

<!DOCTYPE html>
<html><head><title>Sign in to continue</title>...

The gateway returned its login page instead of the API response. Authenticate to the proxy or allowlist the API host.

Empty body with status 200
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 0

Server-side handler returned success without writing a body — fix the API to return data or a proper error status.

How to fix

  • Inspect the raw body: call the endpoint with curl -i and check what is actually returned before parsing.
  • Check for a proxy or gateway: compare direct-to-origin responses against responses through the proxy (VPN, corporate network, CDN).
  • Verify the Content-Type header is application/json and the body starts with { or [.
  • Paste the raw response into the API response checker below to see exactly why parsing fails, with line/column detail.
  • On the server, return a proper error status (5xx) instead of 200 when the handler fails, so clients can react correctly.

Watch out

  • Retrying blindly will not help when a gateway rewrites the response — every retry gets the same intercepted page.
  • Some SDKs cache malformed responses; clear the cache after fixing the network path.

Related guides

Use our tool

Check API response

Advertisement

All guides