# 404 error=invalid\_request&error\_description=The+request+is+malformed

**URL:** <https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956>\
**Category:** Support\
**Tags:** developers\
**Created:** [November 23, 2024, 8:09pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956 "2024-11-23T20:09:48Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![rst11](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@rst11](https://community.smartthings.com/u/rst11)\
**Post date:** [November 23, 2024, 8:09pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/1 "2024-11-23T20:09:49Z")

</div>

Hi, I am implementing the oauth2 part of my smartapp and the authorize step directs to error=invalid\_request&error\_description=The+request+is+malformed.

I am directing user to  
[https://api.smartthings.com/oauth/authorize?response\_type=code&client\_id=3446d2fc-7541-4758-ad03-e781bb8fb82&redirect\_url=https://www.MYDOMAIN.co.uk:5000/callback](https://api.smartthings.com/oauth/authorize?response_type=code&client_id=3446d2fc-7541-4758-ad03-e781bb8fb82&redirect_url=https://www.MYDOMAIN.co.uk:5000/callback)

as a user I am able to login, select the location and devices and click the authorize button.  
This directs to the [https://api.smartthings.com/installedapp?error=invalid\_request&error\_description=The+request+is+malformed](https://api.smartthings.com/installedapp?error=invalid_request&error_description=The+request+is+malformed). url and a 404 error.

Looking to understand why and how to resolve.

---

<div class="post-metadata">

**Author:** ![nayelyz](https://avatars.discourse-cdn.com/v4/letter/n/59ef9b/32.png) [@nayelyz](https://community.smartthings.com/u/nayelyz)\
**Post date:** [November 25, 2024, 6:10pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/2 "2024-11-25T18:10:52Z")

</div>

Hi, @rst11  
This is weird. You should be redirected to the “redirect URI” you defined in your app’s configuration, along with the authorization code as the query parameter. Have you checked if you receive that request on your server?

I haven’t seen this flow redirecting to the `installedapp` endpoint.

---

<div class="post-metadata">

**Author:** ![rst11](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@rst11](https://community.smartthings.com/u/rst11)\
**Post date:** [November 26, 2024, 9:47pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/3 "2024-11-26T21:47:55Z")

</div>

Hi @nayelyz . does this mean the &redirect\_url= specified on the url the client is being directed to is completely ignored? can i remove it so not to cause confusion.

Are there any logs that i can view that will explain why the there is no call to the url specified on the application registration?

can you explain what you mean by:  
_\>\> I haven’t seen this flow redirecting to the `installedapp` endpoint._

many thanks

---

<div class="post-metadata">

**Author:** ![nayelyz](https://avatars.discourse-cdn.com/v4/letter/n/59ef9b/32.png) [@nayelyz](https://community.smartthings.com/u/nayelyz)\
**Post date:** [November 26, 2024, 10:00pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/4 "2024-11-26T22:00:09Z")

</div>

> [@rst11](#):
>
> &redirect\_url= specified on the url the client is being directed to is completely ignored? can i remove it so not to cause confusion

No, it is used, but it must match the redirect URI you defined in your app’s configuration. Both must be present.

> [@rst11](#):
>
> why the there is no call to the url specified on the application registration?

Not directly, but you can test first if your URL passes this SSL test: [SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest)  
If not, that could be the reason why no request reaches your server.

> [@rst11](#):
>
> [https://api.smartthings.com/installedapp](https://api.smartthings.com/installedapp)?

This URL you shared it’s similar to the `installedapp` endpoint of the API: [API | Developer Documentation | SmartThings](https://developer.smartthings.com/docs/api/public/#tag/Installedapps/operation/listInstallations)  
So, I just was wondering why it was redirected there.

If the URL passes the test, we would need your help by replicating the issue and providing this information:

1. App ID
2. Timestamp of when you tried to authorize your app including your timezone. For example: 14:00 GMT-6

---

<div class="post-metadata">

**Author:** ![rst11](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@rst11](https://community.smartthings.com/u/rst11)\
**Post date:** [November 29, 2024, 4:08pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/5 "2024-11-29T16:08:56Z")

</div>

Hi @nayleyz. My app https address and certiciate all pass. How can i privately send you the details you have asked for?

---

<div class="post-metadata">

**Author:** ![nayelyz](https://avatars.discourse-cdn.com/v4/letter/n/59ef9b/32.png) [@nayelyz](https://community.smartthings.com/u/nayelyz)\
**Post date:** [November 29, 2024, 4:26pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/6 "2024-11-29T16:26:00Z")

</div>

Hi, @rst11, you can send me a direct message in this forum or an email to [build@smartthings.com](mailto:build@smartthings.com).

---

<div class="post-metadata">

**Author:** ![rst11](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@rst11](https://community.smartthings.com/u/rst11)\
**Post date:** [November 29, 2024, 6:42pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/7 "2024-11-29T18:42:44Z")

</div>

Hi Nayelyz. I have sent you a message. Thanks!

---

<div class="post-metadata">

**Author:** ![Dyaa\_4](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dyaa_4/32/211681_2.png) [@Dyaa\_4](https://community.smartthings.com/u/Dyaa_4)\
**Post date:** [March 2, 2025, 1:37pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/9 "2025-03-02T13:37:15Z")

</div>

I have the same problem. I also wrote an email. Thank you!

---

<div class="post-metadata">

**Author:** ![orangebucket](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/orangebucket/32/81590_2.png) [@orangebucket](https://community.smartthings.com/u/orangebucket)\
**Post date:** [March 2, 2025, 2:35pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/10 "2025-03-02T14:35:01Z")

</div>

> [@Dyaa\_4](#):
>
> I have the same problem. I also wrote an email. Thank you!

Something I have observed is that using the CLI command `smartthings apps:oauth:generate` (at least I think it was that one) results in a spurious `https://apps.smartthings.com/installedapp/` being added as the first entry in the `redirectUris` array. There is still no obvious reason why it should be used instead of the specified one but I’ve had it happen.

---

<div class="post-metadata">

**Author:** ![Dyaa\_4](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dyaa_4/32/211681_2.png) [@Dyaa\_4](https://community.smartthings.com/u/Dyaa_4)\
**Post date:** [March 2, 2025, 2:52pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/12 "2025-03-02T14:52:04Z")

</div>

I do not use this command. I create the app via Postman and I’ve defined my REDIRECT\_URI in the body. If the URI were incorrect, I would receive an error in the response body stating that the REDIRECT\_URI is invalid

Thank you

---

<div class="post-metadata">

**Author:** ![Itati](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@Itati](https://community.smartthings.com/u/Itati)\
**Post date:** [March 3, 2025, 6:26pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/13 "2025-03-03T18:26:47Z")

</div>

Hi @Dyaa_4

We received your email and noticed that your app type is **App Type: WEBHOOK\_SMART\_APP**. The correct app type should be **API\_ONLY**.

Here are some instructions that might help you:

1. The option to create OAuth integrations cannot be found in the Developer Workspace.
2. You need to use the SmartThings CLI to create this type of app

> [@](#):
>
> Command:  
> `smartthings apps:create`  
> ----\>The type you need to select is “OAuth-In App”  
> ----\> Target URL is the link where you want to receive the subscription events  
> ----\> These scopes are the permissions whitelisted from your app, if you use a scope in the “authorize URL” not included in your app’s scopes, you’ll get an error  
> -----\> Add redirect URI because that’s where you’ll receive the authorization code once the user authorizes access to your app.3. 4.

1. You can also use the JSON in this sample as the input for the command.  
GitHub - SmartThingsCommunity/api-app-subscription-example-js: Example API Access SmartApp that shows the state and allows control of devices]([GitHub - SmartThingsCommunity/api-app-subscription-example-js: Example API Access SmartApp that shows the state and allows control of devices](https://github.com/SmartThingsCommunity/api-app-subscription-example-js?tab=readme-ov-file#2-register-your-smartthings-app))
2. Then, you need to start the OAuth 2.0 process which consists on:

> [@](#):
>
> 1. Show the authorization page to the user by using this URL:  
> `<https://api.smartthings.com/oauth/authorize?client_id=${clientId_from_app}&response_type=code&redirect_uri=${redirect_uri_from_app}&scope=${scopes_from_whitelisted_inApp}`\>
> 2. Once the user authorizes access to your app, it’ll redirect you to the “Redirect URI” you configured with the Authorization Code.
> 3. You’ll exchange this code for an Access Token. This is an example of that request:  
> `curl -X POST "<https://api.smartthings.com/oauth/token>" -u "${clientId_from_app}":"${clientSecret_from_app}" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=authorization_code&client_id=${clientId_from_app}&code=${codeReceived}&redirect_uri=${redirect_uri_from_app}"`

1. The Access Token you get expires in 24 hours.
2. The Refresh Token expires in 29 days **if not used**. We suggest you refresh the token before this time, otherwise, you’ll lose the Refresh token and the User will need to re-authorize.

> **NOTE: Remember the OAuth integration has a** [**limit of 500 installations by default**](https://developer.smartthings.com/docs/connected-services/oauth-integrations#install-limits) **. Each time a user authorizes access to one of his/her locations, it will count as 1 installation. This means, if a user has 3 locations and authorizes access to each of them, he/she will use 3 installations.**

1. To refresh the Access Token, you need to use the same endpoint but the `grant_type` is different, here’s an example about this:
2. 

> curl -X POST “[https://api.smartthings.com/oauth/token](https://api.smartthings.com/oauth/token)” -u “${clientId\_from\_app}”:“${clientSecret\_from\_app}” -H “Content-Type: application/x-www-form-urlencoded” -d “grant\_type=refresh\_token&client\_id=${clientId\_from\_app}&refresh\_token=${latest\_refresh\_token}”

---

<div class="post-metadata">

**Author:** ![Dyaa\_4](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dyaa_4/32/211681_2.png) [@Dyaa\_4](https://community.smartthings.com/u/Dyaa_4)\
**Post date:** [March 3, 2025, 9:07pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/14 "2025-03-03T21:07:55Z")

</div>

thank you so much for the fast response. I will try that

---

<div class="post-metadata">

**Author:** ![Dyaa\_4](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dyaa_4/32/211681_2.png) [@Dyaa\_4](https://community.smartthings.com/u/Dyaa_4)\
**Post date:** [August 5, 2025, 6:23pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/15 "2025-08-05T18:23:25Z")

</div>

Hey, I tried that, but I need `WEBHOOK_SMART_APP` to receive calls from SmartThings when a device changes its state. When I use the `API_ONLY` type, I can’t use the webhook functionality. i need a way to use the api to controll my device state and to get his state from the webhook

---

<div class="post-metadata">

**Author:** ![orangebucket](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/orangebucket/32/81590_2.png) [@orangebucket](https://community.smartthings.com/u/orangebucket)\
**Post date:** [August 5, 2025, 8:53pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/16 "2025-08-05T20:53:03Z")

</div>

> [@Dyaa\_4](#):
>
> Hey, I tried that, but I need `WEBHOOK_SMART_APP` to receive calls from SmartThings when a device changes its state. When I use the `API_ONLY` type, I can’t use the webhook functionality. i need a way to use the api to controll my device state and to get his state from the webhook

API\_ONLY apps receive CONFIRMATION and EVENT messages from SmartThings on the ‘target URL’ just as WEBHOOK\_SMART\_APP apps do. The difference is that instead of a `lifecycle` property in a request from SmartThings you get a `messageType`.

As you are basically setting things up from the server end rather than responding to requests from SmartThings, you don’t get CONFIGURATION, INSTALL, or UPDATE lifecycle requests. However you can still create subscriptions as you would typically have done in response to those INSTALL or UPDATE requests and you will receive EVENT messages.

---

<div class="post-metadata">

**Author:** ![Dyaa\_4](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dyaa_4/32/211681_2.png) [@Dyaa\_4](https://community.smartthings.com/u/Dyaa_4)\
**Post date:** [August 5, 2025, 8:54pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/17 "2025-08-05T20:54:43Z")

</div>

Hey Orangebucket, thank you so much for your answer i tried to subscribe for my device, but SmartThings didn’t trigger or call my webhook, my webhook is also currect “apiOnly”: {  
“targetUrl”: “[https://api.screen-board.com/api/auth/smartthings/webhook](https://api.screen-board.com/api/auth/smartthings/webhook)”

---

<div class="post-metadata">

**Author:** ![Dyaa\_4](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dyaa_4/32/211681_2.png) [@Dyaa\_4](https://community.smartthings.com/u/Dyaa_4)\
**Post date:** [August 5, 2025, 9:03pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/18 "2025-08-05T21:03:44Z")

</div>

I have set up my webhook with

```auto
router.post("/auth/smartthings/webhook", (req, res) =>
    smartThingsController.handleWebhook(req, res));

```

I believe I’ve done everything correctly, but Samsung/SmartThings never calls the webhook. I tested by turning off the light via Alexa, but nothing happens—even though I have an active subscription.

---

<div class="post-metadata">

**Author:** ![orangebucket](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/orangebucket/32/81590_2.png) [@orangebucket](https://community.smartthings.com/u/orangebucket)\
**Post date:** [August 5, 2025, 9:17pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/19 "2025-08-05T21:17:12Z")

</div>

> [@Dyaa\_4](#):
>
> my webhook is also currect “apiOnly”: {  
> “targetUrl”: “[https://api.screen-board.com/api/auth/smartthings/webhook”](https://api.screen-board.com/api/auth/smartthings/webhook%E2%80%9D)

I believe that’s how it looks in the input when creating or updating apps from JSON, but it should end up looking like this is the app object when it is ready to go:

```json
    "apiOnly": {
        "subscription": {
            "targetUrl": "https://api.screen-board.com/api/auth/smartthings/webhook",
            "targetStatus": "CONFIRMED"
        }
    },

```

You need to use `smartthings apps:register` (or an API equivalent) to trigger the CONFIRMATION cycle to verify your target URL (though I believe it also gets called if you define the target URL when you first create an app). That’s the same deal as with Webhook SmartApps.

---

<div class="post-metadata">

**Author:** ![Dyaa\_4](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dyaa_4/32/211681_2.png) [@Dyaa\_4](https://community.smartthings.com/u/Dyaa_4)\
**Post date:** [August 5, 2025, 9:30pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/20 "2025-08-05T21:30:45Z")

</div>

> [@orangebucket](#):
>
> smartthings apps:register

oh thank you so much ! i did now. Registration request sent to app xxxxx. Check server log for confirmation URL: undefined i will try

---

<div class="post-metadata">

**Author:** ![Dyaa\_4](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/dyaa_4/32/211681_2.png) [@Dyaa\_4](https://community.smartthings.com/u/Dyaa_4)\
**Post date:** [August 7, 2025, 10:51pm UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/21 "2025-08-07T22:51:52Z")

</div>

**Thank you so much, I got my events!**

Last thing:  
How long is the subscription valid?  
Does it not have an expiration?

---

<div class="post-metadata">

**Author:** ![orangebucket](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/orangebucket/32/81590_2.png) [@orangebucket](https://community.smartthings.com/u/orangebucket)\
**Post date:** [August 8, 2025, 6:18am UTC](https://community.smartthings.com/t/404-error-invalid-request-error-description-the-request-is-malformed/290956/22 "2025-08-08T06:18:43Z")

</div>

> [@Dyaa\_4](#):
>
> How long is the subscription valid?  
> Does it not have an expiration?

Perhaps slightly surprisingly, they don’t expire. You just have to delete them when you no longer need them.