{"record":{"id":"0ec13e5f20843756","repo":"ory/kratos","slug":"at-most-d-ids-may-be-provided-per-call","errorCode":null,"errorMessage":"at most %d IDs may be provided per call","messagePattern":"at most (.+?) IDs may be provided per call","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"session/handler.go","lineNumber":1394,"sourceCode":"// accept wildcard should call parseManageSessionsIDs directly so the token is\n// rejected.\nfunc parseManageSessionsIDsOrWildcard(raw []string) (ids []uuid.UUID, wildcard bool, err error) {\n\tif len(raw) == 1 && raw[0] == ManageSessionsAllToken {\n\t\treturn nil, true, nil\n\t}\n\tids, err = parseManageSessionsIDs(raw)\n\treturn ids, false, err\n}\n\n// parseManageSessionsIDs interprets a manage-sessions filter array as a list\n// of explicit UUIDs and rejects any input containing the wildcard token.\n// Callers that accept the wildcard must use parseManageSessionsIDsOrWildcard.\nfunc parseManageSessionsIDs(raw []string) ([]uuid.UUID, error) {\n\tif len(raw) == 0 {\n\t\treturn nil, errors.New(\"array must not be empty\")\n\t}\n\tif len(raw) > ManageSessionsMaxIDs {\n\t\treturn nil, fmt.Errorf(\"at most %d IDs may be provided per call\", ManageSessionsMaxIDs)\n\t}\n\tids := make([]uuid.UUID, 0, len(raw))\n\tfor _, s := range raw {\n\t\tif s == ManageSessionsAllToken {\n\t\t\treturn nil, errors.New(\"the wildcard '*' is not accepted here\")\n\t\t}\n\t\tid, err := uuid.FromString(s)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not parse %q as UUID: %w\", s, err)\n\t\t}\n\t\tids = append(ids, id)\n\t}\n\treturn ids, nil\n}\n\n// wildcardBatch runs a single chunked bulk-session operation and packages the\n// row count plus a `more` flag for the response. `more` is true when the call\n// reached the per-call batch limit, signaling that the caller should re-issue","sourceCodeStart":1376,"sourceCodeEnd":1412,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/session/handler.go#L1376-L1412","documentation":"parseManageSessionsIDs enforces a hard upper bound of ManageSessionsMaxIDs session UUIDs per call; exceeding it returns this error. The limit exists to keep the request payload and the resulting session-lookup/invalidation work bounded.","triggerScenarios":"Calling the session management endpoint with more than ManageSessionsMaxIDs UUIDs in the IDs array (e.g. batch-disabling thousands of sessions in one request). Check ManageSessionsMaxIDs in session/handler.go for the exact cap.","commonSituations":"Admin tooling that tries to disable every user session in one bulk call; sync jobs exporting all stale sessions and posting them in a single request; scripts written before the batch limit was introduced.","solutions":["Split the ID list into chunks of at most ManageSessionsMaxIDs and issue one API call per chunk.","Fetch the cap from the exported ManageSessionsMaxIDs constant (or probe server behavior) and chunk dynamically instead of hard-coding a larger size.","If the goal is to invalidate all sessions for a user/identity, use the wildcard ('*') variant of the endpoint rather than enumerating every ID.","Batch client-side: accumulate session IDs and flush when the chunk size is reached."],"exampleFix":"// before\nawait ory.disableSessions({ session_ids: allIds })  // allIds.length > ManageSessionsMaxIDs\n// after\nfor (let i = 0; i < allIds.length; i += ManageSessionsMaxIDs) {\n  await ory.disableSessions({ session_ids: allIds.slice(i, i + ManageSessionsMaxIDs) })\n}","handlingStrategy":"validation","validationCode":"const MAX = 30 /* ManageSessionsMaxIDs */\nif (sessionIds.length > MAX) {\n  throw new Error(`chunk required: max ${MAX} ids per call`)\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"may be provided per call\") {\n    // split the list and retry in batches\n}","preventionTips":["Chunk bulk disable requests to ManageSessionsMaxIDs per call","Use the wildcard/all-sessions endpoint instead of enumerating every ID","Batch client-side and flush when the cap is reached"],"tags":["session-management","api","payload-limit"],"backgroundTag":"value-out-of-range","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}