{"record":{"id":"4986959e9668ce7d","repo":"langfuse/langfuse","slug":"invalid-request-parameters-498695","errorCode":null,"errorMessage":"Invalid request parameters","messagePattern":"Invalid request parameters","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"web/src/pages/api/public/projects/[projectId]/apiKeys/[apiKeyId].ts","lineNumber":70,"sourceCode":"      })\n    ) {\n      return res.status(403).json({\n        error: \"This feature is not available on your current plan.\",\n      });\n    }\n\n    const rateLimitCheck =\n      await RateLimitService.getInstance().rateLimitRequest(\n        authCheck.scope,\n        \"public-api\",\n      );\n    if (rateLimitCheck?.isRateLimited()) {\n      return rateLimitCheck.sendRestResponseIfLimited(res);\n    }\n\n    const params = validateQueryParams(req.query);\n    if (!params) {\n      return res.status(400).json({ message: \"Invalid request parameters\" });\n    }\n\n    const { projectId, apiKeyId } = params;\n\n    // Check if project exists and belongs to the organization\n    const project = await prisma.project.findFirst({\n      where: {\n        id: projectId,\n        orgId: authCheck.scope.orgId,\n      },\n    });\n\n    if (!project) {\n      return res\n        .status(404)\n        .json({ message: \"Project not found or you don't have access to it\" });\n    }\n","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/langfuse/langfuse/blob/59d92c7cf365150d10b753b5a0d1708902a2ed60/web/src/pages/api/public/projects/[projectId]/apiKeys/[apiKeyId].ts#L52-L88","documentation":"The query/path parameters for DELETE /api/public/projects/{projectId}/apiKeys/{apiKeyId} failed Zod-style validation in validateQueryParams. Both projectId and apiKeyId must be present and valid; otherwise a 400 is returned before any database lookup.","triggerScenarios":"Omitting apiKeyId from the path, passing empty strings (e.g. /apiKeys/ or /apiKeys/%20), or non-string values caused by duplicated query params or malformed URL construction.","commonSituations":"Template-literal URL building with undefined variables, URL-encoding issues, or copy-pasting the collection route without appending the key id.","solutions":["Ensure the request path is exactly /api/public/projects/{projectId}/apiKeys/{apiKeyId} with both ids as non-empty strings.","Log the final URL before sending to catch undefined/empty interpolations.","Regenerate the API client from the current Fern/OpenAPI spec so required path params are enforced at compile time."],"exampleFix":"// before\nfetch(`${baseUrl}/api/public/projects/${projectId}/apiKeys/${undefined}`)\n// after\nfetch(`${baseUrl}/api/public/projects/${projectId}/apiKeys/${encodeURIComponent(apiKeyId)}`)","handlingStrategy":"validation","validationCode":"if (typeof projectId !== 'string' || !projectId) throw new Error('projectId required');\nif (typeof apiKeyId !== 'string' || !apiKeyId) throw new Error('apiKeyId required');\nconst url = `${baseUrl}/api/public/projects/${encodeURIComponent(projectId)}/apiKeys/${encodeURIComponent(apiKeyId)}`;","typeGuard":"function isValidId(id: unknown): id is string {\n  return typeof id === 'string' && id.trim().length > 0;\n}","tryCatchPattern":null,"preventionTips":["Always encode path params and assert non-empty strings.","Use the generated API client so required params are compile-time enforced."],"tags":["http-400","validation","path-params","zod"],"backgroundTag":"request-validation-failed","analyzedSha":"59d92c7cf365150d10b753b5a0d1708902a2ed60","analyzedAt":"2026-08-27T22:22:00.402Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}