{"record":{"id":"218f1ecc63b5b511","repo":"Mintplex-Labs/anything-llm","slug":"invalid-invite-id","errorCode":null,"errorMessage":"Invalid invite id","messagePattern":"Invalid invite id","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"server/endpoints/api/admin/index.js","lineNumber":419,"sourceCode":"      schema: {\n        \"$ref\": \"#/definitions/InvalidAPIKey\"\n      }\n    }\n     #swagger.responses[401] = {\n      description: \"Instance is not in Multi-User mode. Method denied\",\n    }\n    */\n      try {\n        if (!multiUserMode(response)) {\n          response.sendStatus(401).end();\n          return;\n        }\n\n        const { id } = request.params;\n        const parsedId = Number(id);\n        if (isNaN(parsedId)) {\n          response\n            .status(400)\n            .json({ success: false, error: \"Invalid invite id\" });\n          return;\n        }\n\n        const { success, error } = await Invite.deactivate(parsedId);\n        if (!success) {\n          response.status(404).json({\n            success: false,\n            error: \"Invite not found or already disabled\",\n          });\n          return;\n        }\n\n        response.status(200).json({ success, error });\n      } catch (e) {\n        console.error(e);\n        response.sendStatus(500).end();\n      }","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/endpoints/api/admin/index.js#L401-L437","documentation":"The admin invite-deactivation API route (/v1/admin/invite/deactivate/:id) returns this 400 when Number(request.params.id) is NaN — i.e. the route parameter is not a numeric string. AnythingLLM invite ids are integer Prisma IDs, so letters, empty strings, '12abc', or floats like '1.5' (Number parses but later findUnique mismatches) fail validation before the DB is touched.","triggerScenarios":"Calling the route with /deactivate/abc, /deactivate/undefined, /deactivate/null, or a URL-encoded non-numeric id; templating bugs interpolating an undefined variable into the path.","commonSituations":"Scripts that pass the invite code string instead of the numeric id; string interpolation mistakes ('/deactivate/' + id with id undefined); copy-paste of the invite code into an admin script.","solutions":["Pass the numeric invite id from the invite list API (GET admin invites), not the invite code","Client-side, guard Number(id) and Number.isInteger before making the call","Check your URL template for undefined interpolations"],"exampleFix":"// before\nconst url = `/api/v1/admin/invite/deactivate/${invite.code}`; // code is not numeric -> 400\n\n// after\nconst url = `/api/v1/admin/invite/deactivate/${invite.id}`; // integer id from the invites list","handlingStrategy":"type-guard","validationCode":"function toInviteId(raw) {\n  const n = Number(raw);\n  if (!Number.isInteger(n) || n <= 0) throw new TypeError(`invite id must be an integer, got ${typeof raw}`);\n  return n;\n}","typeGuard":"function isNumericInviteId(v) {\n  return (typeof v === 'number' || typeof v === 'string') &&\n    String(v).trim() !== '' &&\n    Number.isInteger(Number(v));\n}","tryCatchPattern":null,"preventionTips":["Use the invite's numeric `id` from the admin invites list, never the invite code string","Guard template URLs: if id is undefined, fail fast client-side instead of issuing the request"],"tags":["admin-api","invites","http-400","route-parameter"],"backgroundTag":"invalid-route-parameter","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}