Facebook CAPI 400 Bad Request: The Fix for Make.com

What the 400 error actually says

If your Make.com HTTP module is returning a red error, the response body from Meta typically looks like this:

{
  "error": {
    "message": "Invalid parameter",
    "type": "OAuthException",
    "code": 100,
    "error_subcode": 2804019,
    "is_transient": false,
    "error_user_title": "Missing required parameter",
    "error_user_msg": "A required parameter is missing from your request."
  }
}

The three most common triggers, in order of frequency:

• Missing the data array wrapper — the event object must be inside a data: [...] array, even if you’re only sending one event.
• Unhashed personal data — sending a raw email instead of a normalized, SHA-256-hashed string.
• Invalid event_time format — Meta requires a 10-digit UNIX timestamp, not a formatted date string.

The correct payload structure

This is the structure to use in your Make.com HTTP module’s request body. Replace the bracketed Make.com variable references with the fields from your actual data source.

{
  "data": [
    {
      "event_name": "Purchase",
      "event_time": {{formatDate(now; "X")}},
      "action_source": "website",
      "user_data": {
        "em": ["{{sha256(lower(trim(1.email)); "hex")}}"],
        "ph": ["{{sha256(1.phone; "hex")}}"],
        "client_ip_address": "{{1.ip_address}}",
        "client_user_agent": "{{1.user_agent}}"
      },
      "custom_data": {
        "currency": "USD",
        "value": {{1.purchase_value}}
      }
    }
  ]
}

Setting it up step by step

1. Configure the HTTP module

In Make.com, add a Make a request HTTP module with these settings:

• URL: https://graph.facebook.com/{API_VERSION}/{PIXEL_ID}/events?access_token={ACCESS_TOKEN} — use the current Graph API version from Meta’s changelog rather than hardcoding an old one, since versions are deprecated roughly every two years.
• Method: POST
• Headers: Content-Type set to application/json
• Body type: Raw, with the JSON structure from above as the request content

2. Normalize and hash personal data

Meta’s Event Match Quality scoring depends on the em (email) and ph (phone) fields matching what Meta has on file — which requires hashing the value the same way Meta does. Before hashing, normalize the string: lowercase it and trim any leading or trailing whitespace. The combined formula in Make.com looks like this:

{{sha256(lower(trim(1.email)); "hex")}}

Skipping the lower() or trim() steps produces a hash that technically validates as a string but won’t match Meta’s own hash of the same email — so the event passes the 400 check but contributes little to match quality.

3. Format the timestamp correctly

The event_time field must be a UNIX timestamp — seconds since January 1, 1970, as an integer, not a string. Make.com’s {{formatDate(now; "X")}} function produces exactly this format from the current execution time.

Common mistakes checklist

Before re-running the scenario, check the payload against each of these:

• ✕ Sending a plain-text email instead of a normalized, hashed string
• ✕ Forgetting the array brackets around em and ph — they must be "em": ["hash"], not "em": "hash"
• ✕ Omitting action_source (set to "website" for most web-based events)
• ✕ A trailing comma after the last item in a JSON object — this is a strict syntax error that breaks the whole payload

Still getting a 400? Deeper issues

If the payload structure, hashing, and timestamp are all correct and it’s still failing, check these less obvious causes:

The May 2026 Make.com reauthorization issue

Testing before you go live

Don’t validate a new payload structure against live production traffic. In Meta Events Manager, open your pixel and go to the Test Events tab — this generates a unique test_event_code.

Add that code to your payload as an additional field inside the event object: "test_event_code": "TEST81014". Run the Make.com scenario once. The test event should appear in Events Manager’s Test Events tab within a few seconds, confirming the payload structure is valid before you remove the test code and go live. You can also validate the JSON structure independently using Meta’s Conversions API payload helper.

Once the test event is confirmed, remove the test_event_code field and the module will return 200 OK with an events_received count for live traffic.

Do you need Make.com for this at all?

Worth knowing before debugging further: Meta introduced a one-click Conversions API setup directly inside Events Manager in April 2026, designed for advertisers with a single, standard data source (typically a Shopify or WooCommerce store) who don’t need custom routing logic.

A Make.com scenario is still the right call when you need to combine data from multiple sources, apply business-specific filtering before an event is sent, route the same conversion to several ad platforms, or handle data that doesn’t come from a supported e-commerce platform — a custom CRM, for instance. If your setup is a single store sending standard purchase events, it’s worth checking Meta’s native one-click option first; it may remove the need for this entire troubleshooting process.

FAQ – Facebook CAPI 400 Bad Request Make.com