{"record":{"id":"1c4a5af865d6daef","repo":"passbolt/passbolt_api","slug":"the-scim-setting-id-should-be-a-valid-uuid","errorCode":null,"errorMessage":"The SCIM setting id should be a valid UUID.","messagePattern":"The SCIM setting id should be a valid UUID\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Controller/ScimDeleteSettingsController.php","lineNumber":39,"sourceCode":"use Cake\\Validation\\Validation;\nuse Passbolt\\Scim\\Service\\ScimDeleteSettingsService;\n\nclass ScimDeleteSettingsController extends AppController\n{\n    /**\n     * SCIM DELETE action\n     *\n     * @param string|null $id ID of the setting to delete\n     * @return void\n     */\n    public function deleteSettings(?string $id): void\n    {\n        $this->assertJson();\n        $this->User->assertIsAdmin();\n\n        // Check request sanity\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The SCIM setting id should be a valid UUID.'));\n        }\n\n        $service = new ScimDeleteSettingsService();\n        $service->deleteSettings($this->User->getAccessControl(), $id);\n        $this->success(__('The operation was successful.'));\n    }\n}\n","sourceCodeStart":21,"sourceCodeEnd":47,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Controller/ScimDeleteSettingsController.php#L21-L47","documentation":"BadRequestException raised in ScimDeleteSettingsController::deleteSettings when the SCIM settings id in the URL fails CakePHP's Validation::uuid() check. SCIM setting identifiers must be valid UUIDs; anything else is rejected before the deletion service is invoked.","triggerScenarios":"DELETE request to a SCIM settings endpoint whose {id} path segment is not a UUID (e.g. 'latest', a numeric id, an empty or truncated string).","commonSituations":"Client substitutes a SCIM setting name or a database auto-increment id instead of the UUID; copy/paste truncated the UUID; constructing the URL from a wrong record field after an API version change.","solutions":["Fetch the SCIM settings list and use the actual UUID id of the settings record in the DELETE URL","Validate the id is a UUID string before building the request URL","Check the response of the GET settings endpoint / migration output for the correct identifier format"],"exampleFix":"// before\ndelete('/scim/settings/latest.json');\n// after\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (UUID_RE.test(id)) delete(`/scim/settings/${id}.json`);","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!UUID_RE.test(id)) throw new Error(`Not a valid SCIM settings UUID: ${id}`);","typeGuard":"const isUuid = (v: unknown): v is string => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);","tryCatchPattern":"try { await deleteScimSettings(id); } catch (e) { if (e.status === 400) throw new Error(`Invalid SCIM settings id: ${id}`); throw e; }","preventionTips":["Obtain ids from the settings list endpoint, never hand-construct them","Validate UUID format client-side before calling DELETE","Avoid storing truncated ids from copy/paste or logs"],"tags":["scim","uuid","bad-request"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}