Geocoding API errors explained

What “Access blocked”, 403, 429 and 509 mean on Nominatim, what OVER_QUERY_LIMIT and REQUEST_DENIED mean on Google, why geopy returns nothing, and why a search finds no house number. Each with the usual cause and the fix.

Nominatim: “Access blocked” and 403 Forbidden

The public server at nominatim.openstreetmap.org is run by the OpenStreetMap Foundation on donated hardware. Other apps may use it within its usage policy: at most one request per second, a User-Agent or Referer that identifies the app, results cached on your side, and no autocomplete. When a client breaks the policy, the server answers 403 with a page titled “Access blocked”, which names the usual causes: a missing identification and too many bulk requests.

• A missing or generic User-Agent is the most common cause. Scripts that send the default header of their HTTP library, such as python-requests/2.32 or an empty one, get blocked quickly. Send a header that names your app and how to reach you, such as User-Agent: shop-locator/1.2 (admin@example.com).
• Requests faster than one a second, or the same query sent again and again, are treated as abuse.
• Browsers send the Referer of the page, which identifies the website. A page with Referrer-Policy: no-referrer sends none.

A block lifts once the client is fixed. If it stays, the block page asks you to write to nominatim@openstreetmap.org. The details, with code for curl, Python and JavaScript, are in the guide Nominatim: “Access blocked”, 403 and 429.

429 Too Many Requests

The service limits requests per second or per minute, or the requests of the month are used up. Most services send a Retry-After header with the seconds to wait.

• Wait as long as Retry-After says, then send again. Do not retry at once in a loop: that keeps the client over the limit and can turn a 429 into a block.
• Cache answers. Many apps geocode the same addresses again and again.
• For bulk geocoding of a list, pace the requests in one thread instead of sending them in parallel.

Nominatim: 509 Bandwidth Limit Exceeded

In February 2026 the public Nominatim came under extreme load from anonymous scrapers spread across more than 100,000 IP addresses, as the OpenStreetMap operations team reported. The measures against them answered some normal clients with 509 for a few days. The Nominatim maintainers asked users to retry before reporting it, and recommended a commercial geocoding service or a server of your own for commercial apps (forum thread).

geopy exceptions

geopy raises an exception for every answer other than 200. The most common:

The guide geopy: GeocoderInsufficientPrivileges, GeocoderRateLimited and ConfigurationError has the full table, the user agents geopy refuses, and RateLimiter settings that work.

geopy returns None for every row

RateLimiter from geopy.extra.rate_limiter retries a failed request twice, 5 seconds apart, and then returns None instead of raising (swallow_exceptions=True by default). A blocked script therefore fills a whole column with None, and the reason is only in the log warnings. Set swallow_exceptions=False while testing, so the first error stops the run.

Google Geocoding API: REQUEST_DENIED and OVER_QUERY_LIMIT

The Google API answers HTTP 200 with a status field. REQUEST_DENIED means the request was rejected, OVER_QUERY_LIMIT that a quota is used up, and OVER_DAILY_LIMIT usually a missing or invalid key, billing that is not set up, or a usage cap you set yourself. The error_message field says which, for example “This API project is not authorized to use this API.” (the Geocoding API is not enabled in the project) or “API keys with referer restrictions cannot be used with this API.” (a browser key sent from a server). Each status with its fix is in Google Geocoding API: REQUEST_DENIED, OVER_QUERY_LIMIT and ZERO_RESULTS.

Empty results, ZERO_RESULTS and “Unable to geocode”

The search worked but found nothing. Nominatim answers [] for a search and {"error": "Unable to geocode"} for a point without anything near it; Google answers ZERO_RESULTS.

• The house number is not in the data. Services on OpenStreetMap data know only the house numbers mapped there, which is most of them in much of Europe and fewer in other regions. Search for the street and town to get the street.
• A filter is too strict: a country code, a bounding box or a type filter that leaves the place out.
• The address mixes languages or old names, or puts the postcode in the wrong field of a structured search.
• A typo in a structured field. Free text forgives more than separate fields do.

Search as you type

The usage policy of the public Nominatim forbids autocomplete, also from the browser, and its search is not made for partial words. One request per keystroke also uses up per-second limits quickly. Use a service built for it, such as Photon, and in your code wait about 250 ms after the last keystroke, start at three letters, and drop answers that arrive after a newer request was sent.

“has been blocked by CORS policy”

The browser blocks an answer without an Access-Control-Allow-Origin header. Geocoding APIs for the web send it on normal answers, but error pages often lack it, so a 403 or 429 shows up as a CORS error. Open the network tab, look at the status of the request, and fix that. The Google Geocoding web service is meant for servers; in a browser, use the Geocoder class of the Maps JavaScript API.

400 Bad Request and INVALID_REQUEST

A parameter is missing, misspelled or out of range: lat above 90, an unknown format, a language the service does not have. The message usually names the parameter. Google answers INVALID_REQUEST when address, components or latlng is missing.

Error codes of overpass.ch geocoding

Errors come as JSON, {"error": "rate_limited", "message": "…"}, with CORS headers. All codes are in the documentation.