{"record":{"id":"4940e252b702f3c6","repo":"passbolt/passbolt_api","slug":"could-not-validate-response-data","errorCode":null,"errorMessage":"Could not validate response data.","messagePattern":"Could not validate response data\\.","errorType":"validation","errorClass":"App\\Error\\Exception\\CustomValidationException","httpStatus":null,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryResponses/AccountRecoveryResponsesCreateService.php","lineNumber":142,"sourceCode":"        $service = new AccountRecoveryOrganizationPolicyGetService();\n        $this->policy = $service->get();\n        if ($this->policy->isDisabled()) {\n            $msg = __('Recovery response cannot be created when organization policy is disabled.');\n            throw new BadRequestException($msg);\n        }\n    }\n\n    /**\n     * @throws \\App\\Error\\Exception\\CustomValidationException if the request id is not set, not valid, not found, is not pending\n     * @return \\Passbolt\\AccountRecovery\\Model\\Entity\\AccountRecoveryRequest\n     */\n    public function assertAndGetAssociatedRequest(): AccountRecoveryRequest\n    {\n        $requestId = $this->getData('account_recovery_request_id');\n        $msg = __('Could not validate response data.');\n\n        if (!isset($requestId) || empty($requestId) || !is_string($requestId)) {\n            throw new CustomValidationException($msg, [\n                'account_recovery_request_id' => [\n                    '_required' => 'The account recovery request id is required.',\n                ],\n            ]);\n        }\n\n        if (!Validation::uuid($requestId)) {\n            throw new CustomValidationException($msg, [\n                'account_recovery_request_id' => [\n                    'uuid' => 'The account recovery request must be a uuid.',\n                ],\n            ]);\n        }\n\n        try {\n            $request = $this->AccountRecoveryRequests->get($requestId);\n        } catch (RecordNotFoundException $exception) {\n            throw new CustomValidationException($msg, [","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryResponses/AccountRecoveryResponsesCreateService.php#L124-L160","documentation":"CustomValidationException meaning the response payload failed validation because the account_recovery_request_id field is absent, empty, or not a string. The generic message hides a detailed '_required' error in the validation errors payload.","triggerScenarios":"POST /account-recovery/responses without 'account_recovery_request_id' in the request body, or with null / empty string / non-string value.","commonSituations":"Client forgot the field; request body built dynamically and key omitted; wrong field name used (e.g. requestId); JSON body sent as form-encoded so field lost.","solutions":["Include a valid 'account_recovery_request_id' string field in the POST body.","Fix field naming/serialization so the id is sent with the expected key.","Inspect the error's validation errors detail to confirm '_required' is the failing rule."],"exampleFix":"// before\n$post->post('/account-recovery/responses', ['data' => $armored]);\n// after\n$post->post('/account-recovery/responses', ['account_recovery_request_id' => $requestId, 'data' => $armored]);","handlingStrategy":"validation","validationCode":"if (!isset($data['account_recovery_request_id']) || !is_string($data['account_recovery_request_id']) || $data['account_recovery_request_id'] === '') {\n    throw new InvalidArgumentException('account_recovery_request_id is required.');\n}","typeGuard":"function hasRequestId(array $d): bool { return isset($d['account_recovery_request_id']) && is_string($d['account_recovery_request_id']) && $d['account_recovery_request_id'] !== ''; }","tryCatchPattern":"try {\n    $service->create($uac, $data);\n} catch (\\App\\Error\\Exception\\CustomValidationException $e) {\n    $errors = $e->getErrors(); // inspect account_recovery_request_id._required\n}","preventionTips":["Always set account_recovery_request_id in the payload builder.","Use a DTO/typed request object so the field cannot be omitted.","Send JSON bodies, not form-encoded, to avoid field loss."],"tags":["account-recovery","validation","missing-field"],"backgroundTag":"missing-required-argument","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}