FastAPI returns 422 instead of 401 when the API key header is missing — why, and how should I test it?

If the endpoint (or a dependency) declares the header as required, e.g. x_api_key: str = Header(...), FastAPI validates request inputs before your code runs. A missing header is a validation error, so the response is 422 Unprocessable Entity with detail [{'type': 'missing', 'loc': ['header', 'x-api-key'], ...}]. Your own 'raise HTTPException(401)' only runs when the header is present but wrong. Options: - Accept it and assert 422 for a missing key and 401 for a bad key in tests. - If you want 401 for both, make the header optional (x_api_key: str | None = Header(default=None)) and raise HTTPException(401) yourself when it's None, or use fastapi.security.APIKeyHeader(name='x-api-key', auto_error=False) and check the value.