Mintplex-Labs/anything-llm · warning

Bad Request

Error message

Bad Request

What it means

Returned by DELETE /system/api-key/:id when the `:id` URL parameter is missing, empty, or non-numeric. Line 1079-1080 extracts `const { id } = request.params` then checks `if (!id || isNaN(Number(id))) return response.sendStatus(400).end()`. The ApiKey model's delete method requires `Number(id)` — a numeric primary key — so non-numeric values are rejected before reaching the database layer.

Source

Thrown at server/endpoints/system.js:1080

        response.status(500).json({
          apiKey: null,
          error: "Error generating api key.",
        });
      }
    }
  );

  // TODO: This endpoint is replicated in the admin endpoints file.
  // and should be consolidated to be a single endpoint with flexible role protection.
  app.delete(
    "/system/api-key/:id",
    [validatedRequest],
    async (request, response) => {
      try {
        if (response.locals.multiUserMode)
          return response.sendStatus(401).end();
        const { id } = request.params;
        if (!id || isNaN(Number(id))) return response.sendStatus(400).end();

        await ApiKey.delete({ id: Number(id) });
        await EventLogs.logEvent(
          "api_key_deleted",
          { deletedBy: response.locals?.user?.username },
          response?.locals?.user?.id
        );
        return response.status(200).end();
      } catch (error) {
        console.error(error);
        response.status(500).end();
      }
    }
  );

  app.post(
    "/system/custom-models",
    [validatedRequest, flexUserRoleValid([ROLES.admin])],

View on GitHub (pinned to 526360e320)

Solutions

1. Ensure the :id path parameter is the numeric primary key from the api_keys table, as returned by the GET /system/api-keys listing endpoint.
2. Add a client-side validation that the ID is a positive integer before constructing the request URL.
3. Check the frontend API call for template-literal interpolation bugs (e.g., `${apiKey.id}` resolving to undefined).
4. Inspect the network tab to confirm the actual URL being sent — the :id segment may be empty or contain a non-numeric value.

Example fix

// before
const id = apiKey.uuid; // wrong field
await fetch(`/system/api-key/${id}`, { method: 'DELETE' });

// after
const id = apiKey.id; // numeric primary key
if (!id || isNaN(Number(id))) throw new Error('Invalid API key ID');
await fetch(`/system/api-key/${id}`, { method: 'DELETE' });

function isValidApiKeyId(id) {
  const num = Number(id);
  return id != null && id !== '' && !isNaN(num) && num > 0;
}

// Usage before the request
if (!isValidApiKeyId(apiKey.id)) {
  throw new Error(`Invalid API key ID: ${apiKey.id}. Must be a positive integer.`);
}

function isNumericId(value) {
  return typeof value === 'number' && Number.isInteger(value) && value > 0
    || (typeof value === 'string' && /^\d+$/.test(value) && Number(value) > 0);
}

When it happens

Trigger: The URL path segment for :id is a non-numeric string (e.g. /system/api-key/abc), an empty string, or a UUID. Calling the route without the parameter (some Express routers may allow /system/api-key/ to match with an empty capture) also triggers it.

Common situations: Client code passes a string identifier (UUID, slug) instead of the numeric database row ID. URL construction bug leaves the ID as a literal placeholder like ':id' or undefined. A frontend table row uses the wrong field (e.g., a hash instead of the numeric id column) when building the delete URL.

Related errors

• Bad Request
• Invalid video id!
• Impossible to retrieve Youtube video ID.
• Filename is required!
• Invalid scope: ${JSON.stringify(v)}

AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13). Data as JSON: /api/errors/caaf531d1d3714cc. Report an issue: GitHub.