Significant-Gravitas/AutoGPT · warning · HTTPException

Search query must be at least 3 characters.

Error message

Search query must be at least 3 characters.

What it means

A 400 validation error from the admin user-search endpoint: the query parameter, after strip(), is shorter than 3 characters. The endpoint searches users by partial email/name and enforces a minimum length to prevent near-empty queries from scanning or returning the whole user table.

Source

Thrown at autogpt_platform/backend/backend/api/features/admin/rate_limit_admin_routes.py:265

@router.get(
    "/rate_limit/search_users",
    response_model=list[UserSearchResult],
    summary="Search Users by Name or Email",
)
async def admin_search_users(
    query: str,
    limit: int = 20,
    admin_user_id: str = Security(get_user_id),
) -> list[UserSearchResult]:
    """Search users by partial email or name. Admin-only.

    Queries the User table directly — returns results even for users
    without credit transaction history.
    """
    if len(query.strip()) < 3:
        raise HTTPException(
            status_code=400,
            detail="Search query must be at least 3 characters.",
        )
    logger.info("Admin %s searching users with query=%r", admin_user_id, query)
    results = await search_users(query, limit=max(1, min(limit, 50)))
    return [UserSearchResult(user_id=uid, user_email=email) for uid, email in results]

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Client-side: debounce the typeahead (e.g. 300ms) and only fire the request once the trimmed query length is >= 3.
2. Client-side: strip whitespace before checking length so ' a ' does not slip through as a 1-char effective query.
3. If short queries must work, lengthen the query (full email prefix) rather than changing the endpoint; the 3-char floor is an intentional scan guard.

Example fix

// before
fetch(`/rate_limit/search_users?query=${input}`)  // fires on every keystroke

// after
const q = input.trim();
if (q.length >= 3) fetch(`/rate_limit/search_users?query=${encodeURIComponent(q)}`)

const q = query.trim();
if (q.length < 3) return []; // don't call the endpoint
return await searchUsers(q);

function isSearchableQuery(q: string): boolean {
  return q.trim().length >= 3;
}

When it happens

Trigger: GET /rate_limit/search_users?query=ab (1-2 non-space chars), or a query made only of whitespace such as query=%20%20 (strips to empty), or a client sending the raw first keystrokes of a typeahead box before debouncing.

Common situations: Frontend typeahead firing on every keypress without debounce, sending 1-2 character prefixes; passing an undefined/null query that serializes to an empty or short string; over-aggressive trimming client-side leaving an empty string.

Related errors

• Either user_id or email query parameter is required.
• start and end query params are required
• str(exc)
• Failed to set tier
• url must point at a trusted frontend origin.

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/bd76a60e653f2908. Report an issue: GitHub.