Mintplex-Labs/anything-llm · warning

Bad Request

Error message

Bad Request

What it means

DELETE /admin/delete-api-key/:id (server/endpoints/admin.js:543) returns HTTP 400 via `return response.sendStatus(400).end()` at line 549 when `!id || isNaN(Number(id))` is true. This is an explicit, intentional client-error response, not an exception. It fires when the path parameter is missing, empty, or not parseable as a finite number.

Source

Thrown at server/endpoints/admin.js:549

        );
        return response.status(200).json({
          apiKey,
          error,
        });
      } catch (e) {
        console.error(e);
        response.sendStatus(500).end();
      }
    }
  );

  app.delete(
    "/admin/delete-api-key/:id",
    [validatedRequest, strictMultiUserRoleValid([ROLES.admin])],
    async (request, response) => {
      try {
        const { id } = request.params;
        if (!id || isNaN(Number(id))) return response.sendStatus(400).end();
        await ApiKey.delete({ id: Number(id) });

        await EventLogs.logEvent(
          "api_key_deleted",
          { deletedBy: response.locals?.user?.username },
          response?.locals?.user?.id
        );
        return response.status(200).end();
      } catch (e) {
        console.error(e);
        response.sendStatus(500).end();
      }
    }
  );
}

module.exports = { adminEndpoints };

View on GitHub (pinned to 526360e320)

Solutions

1. On the client, ensure the id is a defined number before constructing the URL.
2. Treat 400 as a programming error — log it on the client and do not auto-retry.
3. If calling from a script, coerce the id with Number() and skip the call when NaN.
4. Confirm the front-end is using the api key's numeric primary key, not its secret string.

const id = Number(request.params.id);
if (!Number.isInteger(id) || id <= 0) {
  return response.status(400).json({ success:false, error:'Invalid api key id' });
}

/** @param {unknown} v */
function isApiKeyId(v) {
  const n = Number(v);
  return typeof v !== 'undefined' && v !== '' && !isNaN(n) && Number.isInteger(n) && n > 0;
}

When it happens

Trigger: DELETE /admin/delete-api-key/ (empty id); DELETE /admin/delete-api-key/abc (non-numeric); DELETE /admin/delete-api-key/undefined (the literal string 'undefined' coming from a JS client that stringified undefined into the URL).

Common situations: Frontend building the URL from a possibly-undefined variable; a malformed route in an integration test; a user editing the URL by hand.

Related errors

• Not Found
• Unauthorized
• Internal Server Error
• Invalid video id!
• Impossible to retrieve Youtube video ID.

AI-assisted analysis of Mintplex-Labs/anything-llm@526360e320 (2026-08-13). Data as JSON: /api/errors/8345330c1bdfb235. Report an issue: GitHub.