{"record":{"id":"540752308f73c777","repo":"passbolt/passbolt_api","slug":"the-authentication-token-id-is-invalid-540752","errorCode":null,"errorMessage":"The authentication token id is invalid.","messagePattern":"The authentication token id is invalid\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryRequests/AccountRecoveryRequestsGetController.php","lineNumber":59,"sourceCode":"    }\n\n    /**\n     * Gets an account recovery request\n     * Sends an email to the admins on suspect request\n     *\n     * @param string|null $requestId Request ID\n     * @param string|null $userId User ID\n     * @param string|null $tokenId Token ID\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the data provided is not valid\n     */\n    public function get(?string $requestId, ?string $userId, ?string $tokenId): void\n    {\n        if (!isset($userId) || !Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user id is invalid.'));\n        }\n        if (!isset($tokenId) || !Validation::uuid($tokenId)) {\n            throw new BadRequestException(__('The authentication token id is invalid.'));\n        }\n        if (!isset($requestId) || !Validation::uuid($requestId)) {\n            throw new BadRequestException(__('The request id is invalid.'));\n        }\n\n        $ip = $this->getRequest()->clientIp();\n\n        $service = new AccountRecoveryRequestGetService();\n        $requestEntity = $service->getNotCompletedOrFail($requestId, $userId, $tokenId, $ip);\n        $data = $service->decorateResults($requestEntity);\n\n        $this->success(__('The operation was successful.'), $data);\n    }\n}\n","sourceCodeStart":41,"sourceCodeEnd":74,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryRequests/AccountRecoveryRequestsGetController.php#L41-L74","documentation":"This BadRequestException is thrown by the account recovery request GET endpoint when the `tokenId` URL parameter is missing (null) or is not a valid UUID. The controller validates all route parameters up-front before delegating to the service layer, so a malformed token id never reaches the database lookup.","triggerScenarios":"GET /account-recovery/requests/<requestId>/<userId>/<tokenId> called with tokenId null, empty, or not a UUID (e.g. truncated token, placeholder value, or wrong URL segment ordering).","commonSituations":"Clients building the recovery URL manually and swapping the userId/tokenId segments; older browser extensions or scripts written for a previous route signature; copy-paste of the link missing the last segment.","solutions":["Verify the client calls the correct route order: /account-recovery/requests/{requestId}/{userId}/{tokenId}.","Ensure the token id passed is the full UUID from the account recovery start response or email link.","Check for null/empty query construction in the client SDK when the token is unavailable.","Log the raw request URL server-side to confirm which segment is malformed."],"exampleFix":"// before\nawait fetch(`/account-recovery/requests/${requestId}/${userId}`); // tokenId missing\n// after\nawait fetch(`/account-recovery/requests/${requestId}/${userId}/${tokenId}`);","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!tokenId || !UUID_RE.test(tokenId)) throw new Error('token id must be a UUID');","typeGuard":"function isValidUuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v); }","tryCatchPattern":"try { await api.getAccountRecoveryRequest(requestId, userId, tokenId); } catch (e) { if (e.code === 400 && /token id is invalid/.test(e.message)) { /* rebuild URL from stored token */ } else { throw e; } }","preventionTips":["Store the full token id from the recovery-start response and reuse it verbatim.","Keep route segment order in a single shared URL builder.","Validate all three UUIDs client-side before the call.","Never hand-assemble recovery links from email text."],"tags":["validation","uuid","bad-request","account-recovery"],"backgroundTag":"invalid-argument-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}