# 425 Too Early

> The server is unwilling to risk processing a request that might be replayed.

Source: https://apiguide.dev/status-codes/425
Class: client-error
Defined in: RFC 8470 <https://www.rfc-editor.org/rfc/rfc8470.html>
Updated: 2026-10-14

## What does HTTP status code 425 mean?

The 425 Too Early status code, defined in RFC 8470, indicates that the server is unwilling to risk processing a request that might be replayed. It applies to requests sent in TLS 1.3 early data (0-RTT), which an attacker can capture and resend. User agents are expected to retry after a 425, and RFC 8470 requires that the retry is not sent in early data.

## When to use it in APIs

Return it when a request arrived in early data, directly or marked by an intermediary with [`Early-Data: 1`](/headers/early-data), and processing a replayed copy would cause a side effect. RFC 8470 says a server should not send 425 unless one of those two conditions holds, because otherwise it cannot assume the client is able to retry.

Do not think of it as protection for `POST` endpoints. Absent other information, RFC 8470 forbids clients from sending unsafe methods in early data, so a `POST` to a payments endpoint should not arrive there in the first place (if one does, reject it with 425 too). The realistic risk is a request the client treated as safe, such as a `GET`, that has a side effect on your server: consuming a single-use link, triggering a one-time action or counting against a metered quota. Decide per route whether early data is acceptable, and answer 425 on the routes where it is not.

## How it compares to other codes

* **400 Bad Request**: The request itself is wrong and resending it unchanged fails again. A 425 request is fine; resending it after the handshake succeeds.
* **409 Conflict**: The request conflicts with current resource state. 425 is about how the request was delivered, not what it asks for.
* **503 Service Unavailable**: The server cannot handle any request right now. 425 refuses only this request in early data, and the retry can be sent immediately once the handshake completes.