diff --git a/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/dashboards/services/PublicServices.java b/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/dashboards/services/PublicServices.java
index 645acc6b210..5bb455f2ba3 100644
--- a/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/dashboards/services/PublicServices.java
+++ b/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/dashboards/services/PublicServices.java
@@ -21,4 +21,13 @@ public static Response buildOkResponseWithOriginHeaders(Object entity) {
                 .entity(entity)
                 .build();
     }
+    public static Response buildBadRequestResponseWithOriginHeaders(Object entity) {
+        return Response
+                .status(Response.Status.BAD_REQUEST)
+                .header(ACCESS_CONTROL_ALLOW_ORIGIN, "*")
+                .header(ACCESS_CONTROL_ALLOW_HEADERS, "*")
+                .header(ACCESS_CONTROL_ALLOW_METHODS, "*")
+                .entity(entity)
+                .build();
+    }
 }
diff --git a/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/publicportal/PublicEndpoint.java b/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/publicportal/PublicEndpoint.java
index 84a1250c578..09dd1700a34 100644
--- a/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/publicportal/PublicEndpoint.java
+++ b/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/publicportal/PublicEndpoint.java
@@ -157,9 +157,9 @@ public Response describeTotalActivities() {
     @ApiResponses(@ApiResponse(code = HttpServletResponse.SC_OK, message = "successful operation",
             response = PublicTopData.class))
     public final Response searchProjects(ReportFormParameters formParams) {
-        ApiErrorResponse result = ReportsUtil.validateReportConfig(formParams, true);
-        if (result != null) {
-            return Response.ok(result).build(); // FIXME return bad request
+        ApiErrorResponse errorResponse = ReportsUtil.validateReportConfig(formParams, true);
+        if (errorResponse != null) {
+           return PublicServices.buildBadRequestResponseWithOriginHeaders(errorResponse);
         }
         // we need reportId only to store the report result in cache
         Long reportId = (long) formParams.getReportName().hashCode();
diff --git a/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/reports/Reports.java b/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/reports/Reports.java
index df0597ca099..638c163ca51 100644
--- a/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/reports/Reports.java
+++ b/amp/src/main/java/org/digijava/kernel/ampapi/endpoints/reports/Reports.java
@@ -291,9 +291,9 @@ public final String getReportResult(
     @ApiResponses(@ApiResponse(code = HttpServletResponse.SC_OK, message = "successful operation",
             response = PagedReportResult.class))
     public final Response getCustomReport(ReportFormParameters formParams) {
-        ApiErrorResponse result = ReportsUtil.validateReportConfig(formParams, true);
-        if (result != null) {
-            return Response.ok(result).build(); // FIXME return bad request
+        ApiErrorResponse errorResponse = ReportsUtil.validateReportConfig(formParams, true);
+        if (errorResponse != null) {
+            return PublicServices.buildBadRequestResponseWithOriginHeaders(errorResponse);
         }
         // we need reportId only to store the report result in cache
         Long reportId = (long) formParams.getReportName().hashCode();