CloudWatch Metric Guide
4XXErrorAmazon API Gateway CloudWatch metric
4XXError counts client-side errors captured by API Gateway in a given period — including throttling (429), authentication/authorization failures (401/403), and modified gateway responses. The Sum statistic gives the raw count; the Average statistic gives the error rate (4XXError count divided by total Count).
What it measures
About 4XXError
4XXError counts client-side errors captured by API Gateway in a given period — including throttling (429), authentication/authorization failures (401/403), and modified gateway responses. The Sum statistic gives the raw count; the Average statistic gives the error rate (4XXError count divided by total Count).
| Namespace | AWS/ApiGateway |
| Metric name | 4XXError |
| Unit | Count |
| AWS docs | Official Amazon API Gateway metrics reference |
Why this metric matters
4XXError is noisier than 5XXError by design — a baseline level of 4xx traffic (expired auth tokens, malformed client requests, bots probing endpoints) is normal on any public API and does not indicate a problem worth paging over. The mistake teams make is alarming on 4XXError the same way they alarm on 5XXError; that produces constant false positives and trains people to ignore the alarm.
What's actually worth watching within 4XXError is 429 (throttled) specifically, since it indicates real capacity problems: either your usage plan / account-level throttle limits are set too low for legitimate traffic, or a client is being throttled in a way that's degrading their experience. A sudden step-change increase in the 4XXError rate — rather than the absolute count — is the more reliable signal that something changed: a client SDK shipped a bug, an API key was revoked, or a deploy broke request validation.
Recommended alarm threshold for 4XXError
Recommended threshold
Average (error rate) rises more than 3x above its trailing 24-hour baseline, sustained for 10 minutes
AWS does not publish a target 4XX rate, and unlike 5XXError there is no sensible fixed percentage — normal 4xx baselines vary enormously by API (public APIs with API keys typically run higher than internal service-to-service APIs). This relative, baseline-based threshold (Nuberio recommendation) is designed to catch a step-change regression — a bad client release, a revoked credential rollout, a throttle limit set too low — rather than firing on ordinary background 4xx noise.
Is your 4XXError alarm already set up correctly?
The free Nuberio Audit scans your CloudWatch setup and flags missing or misconfigured alarms — including 4XXError — in 5 minutes.
Common failures that show up in 4XXError
When 4XXError reaches an alarm threshold, these are the most common root causes — in order of how often Nuberio sees them across customer AWS accounts.
Usage plan or account-level throttling (429) — request volume from one or more clients exceeds the configured rate limit or burst limit
Expired or revoked API keys / auth tokens — a client continues sending requests with credentials that are no longer valid, often after a key rotation
Client-side bug in a newly deployed SDK or app version — malformed request bodies or missing required parameters trigger request validation failures
WAF rule blocking legitimate traffic — an AWS WAF web ACL attached to the API stage starts blocking requests that match an overly broad rule
Resource/route not found (404) after a breaking API change — clients still calling a deprecated or renamed path after a deploy removed it
How the Nuberio Audit checks 4XXError
The free Audit scans every Amazon API Gateway resource in your account and checks whether a 4XXError alarm exists, whether its threshold and evaluation period are configured sensibly, and flags it if it's missing entirely. Every finding comes with the exact CLI command to fix it — read-only access, no credit card, results in about 5 minutes.
Nuberio Audit
Scans your CloudWatch setup for missing or misconfigured 4XXError alarms. Free, 5-minute read-only scan.
Related Amazon API Gateway metrics
4XXError rarely fails in isolation. These metrics tend to correlate — monitor them together for complete Amazon API Gateway coverage.
FAQ
Frequently asked questions about 4XXError
Common questions about setting up CloudWatch alarms for 4XXError in Amazon API Gateway.
What is the recommended CloudWatch alarm threshold for 4XXError?+
Average (error rate) rises more than 3x above its trailing 24-hour baseline, sustained for 10 minutes. AWS does not publish a target 4XX rate, and unlike 5XXError there is no sensible fixed percentage — normal 4xx baselines vary enormously by API (public APIs with API keys typically run higher than internal service-to-service APIs). This relative, baseline-based threshold (Nuberio recommendation) is designed to catch a step-change regression — a bad client release, a revoked credential rollout, a throttle limit set too low — rather than firing on ordinary background 4xx noise.
Which CloudWatch namespace does 4XXError belong to?+
4XXError is published in the AWS/ApiGateway namespace with a unit of Count. You can find it in the CloudWatch console under "Metrics" → "AWS/ApiGateway". See the Amazon API Gateway CloudWatch metrics reference in the AWS documentation.
Does Nuberio automatically create CloudWatch alarms for 4XXError?+
No — the free Nuberio Audit does not create alarms for you. It scans your CloudWatch setup and tells you which Amazon API Gateway resources are missing a 4XXError alarm, then gives you the exact CLI command to create it yourself.
Can I use Nuberio without already having a 4XXError alarm set up?+
Yes. The free Audit works whether or not you have any 4XXError alarm configured — it reads the resource directly from CloudWatch and tells you which resources need one, plus the copy-paste AWS CLI command to create it.
This page is part of the CloudWatch metric guide — thresholds and debugging guidance for every metric across RDS, Lambda, ECS, ALB, EC2, and DynamoDB. To find which Amazon API Gateway alarms your account is missing — including 4XXError — run the free CloudWatch alarm audit. The scan takes under 5 minutes and requires no account.