Errors
CLIENT_IP_INVALID
CLIENT_IP_INVALID
client.ip is not a usable public address for an end user.
Summary
| Field | Value |
|---|---|
| HTTP status | 400 |
errorCategory | validation |
retryable | false |
When This Fires
POST /v1/marketfront/orders/validatePOST /v1/marketfront/orders/place
…when client.ip does not parse as a single IP address, or parses but sits in a range no customer can originate from.
Rejected values
| Kind | Examples |
|---|---|
| Private (RFC 1918) | 10.0.0.1, 172.16.0.5, 192.168.1.1 |
| Loopback | 127.0.0.1, ::1 |
| Unspecified / placeholder | 0.0.0.0, :: |
| Link-local | 169.254.10.1, fe80::1 |
| Carrier-grade NAT (RFC 6598) | 100.64.0.1 |
| Unique-local IPv6 | fd00::1 |
| Reserved / documentation | 192.0.2.0/24, 198.18.0.0/15, 240.0.0.0/4 |
| Not a single address | 203.0.113.7, 70.41.3.18, 203.0.113.7:8080, not-an-ip |
An IPv4-mapped IPv6 address (::ffff:10.0.0.1) is evaluated as the IPv4 address it wraps, so it cannot be used to route around the list above.
Recommended Action
Two mistakes account for almost all of these:
- Sending your own server's address. Your backend's outbound address is usually private or a load-balancer address. Take the customer's address from the request your front end received.
- Sending the whole forwarded-for chain.
client.ipis one address. If you haveX-Forwarded-For: 203.0.113.7, 70.41.3.18, send the first entry — the client — not the joined string.
Code
We validate that the address is shaped like a real client address. We cannot verify that it belongs to the person ordering — that remains your responsibility under the integration agreement.
Example
Code