{"record":{"id":"532326bb91d38bbd","repo":"passbolt/passbolt_api","slug":"api-v1-support-is-deprecated-in-this-version","errorCode":null,"errorMessage":"API v1 support is deprecated in this version.","messagePattern":"API v1 support is deprecated in this version\\.","errorType":"http","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Middleware/ApiVersionMiddleware.php","lineNumber":42,"sourceCode":"use Psr\\Http\\Server\\RequestHandlerInterface;\n\nclass ApiVersionMiddleware implements MiddlewareInterface\n{\n    /**\n     * Throws a bad request if the version passed in the request is not supported.\n     *\n     * @param \\Psr\\Http\\Message\\ServerRequestInterface $request The request.\n     * @param \\Psr\\Http\\Server\\RequestHandlerInterface $handler The request handler.\n     * @return \\Psr\\Http\\Message\\ResponseInterface A response.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the API version provided is deprecated\n     */\n    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface\n    {\n        /** @var \\Cake\\Http\\ServerRequest $request */\n        if ($request->is('json')) {\n            $version = $this->getApiVersion($request);\n            if ($version === 'v1') {\n                throw new BadRequestException('API v1 support is deprecated in this version.');\n            }\n        }\n\n        return $handler->handle($request);\n    }\n\n    /**\n     * Get the request api version.\n     *\n     * @param \\Cake\\Http\\ServerRequest $request Server Request\n     * @return string\n     */\n    public function getApiVersion(ServerRequest $request): string\n    {\n        $apiVersion = $request->getQuery('api-version');\n        // Default to v2 in v3\n        if (!isset($apiVersion) || !is_string($apiVersion)) {\n            return 'v2';","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Middleware/ApiVersionMiddleware.php#L24-L60","documentation":"Passbolt's ApiVersionMiddleware rejects JSON API requests whose version is v1, which was removed from the codebase. Any request still declaring the v1 API (via the URL prefix /v1/... or the version header parsed by getApiVersion) is answered with a 400 BadRequestException instead of being routed.","triggerScenarios":"Any JSON request (request->is('json')) whose resolved API version is 'v1' — e.g. calling legacy endpoints under /v1/users.json or sending an API-version header pinned to v1 — through middleware that includes ApiVersionMiddleware.","commonSituations":"Older CLI clients, browser extensions, or scripts not upgraded after a Passbolt server major upgrade; cached/documented URLs from old integrations; reverse proxies or SDKs still prefixing /v1 to paths.","solutions":["Upgrade the client/SDK to a version speaking the current API (v2).","Remove the /v1 URL prefix from requests (use the unversioned or /v2 paths).","If a custom integration sets the version header, update or remove it so the current default version is used.","Interim workaround only: none recommended; the middleware has no bypass — code migration is required."],"exampleFix":"// before\nGET /v1/users.json\n// after\nGET /users.json  (v2 API, current default)","handlingStrategy":"fallback","validationCode":"// Client pre-check: strip legacy /v1 prefix before sending\nconst url = new URL(path, baseUrl);\nif (url.pathname.startsWith('/v1/')) {\n  url.pathname = url.pathname.replace(/^\\/v1/, '');\n  console.warn('API v1 is deprecated; rewrote request to', url.pathname);\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await request(path); // path may still be v1\n} catch (e) {\n  if (e.response?.status === 400 && /API v1 support is deprecated/.test(e.response.data?.header?.message ?? '')) {\n    return await request(path.replace(/^\\/v1/, '')); // retry on v2\n  }\n  throw e;\n}","preventionTips":["Pin and regularly upgrade the passbolt client/SDK to the server's supported API version.","Grep integrations for '/v1/' URL prefixes and hardcoded v1 version headers after server upgrades.","Watch deprecation notices in release notes when upgrading the passbolt server.","Centralize API path construction so version prefixes are changed in one place."],"tags":["passbolt","cakephp","middleware","api-versioning","deprecation"],"backgroundTag":"deprecated-api-usage","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}