{"record":{"id":"6a9b05caa39221b0","repo":"passbolt/passbolt_api","slug":"this-functionality-is-only-available-using-ajax-json","errorCode":null,"errorMessage":"This functionality is only available using AJAX/JSON.","messagePattern":"This functionality is only available using AJAX/JSON\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaController.php","lineNumber":96,"sourceCode":"     * @throw BadRequestException if the request is of json type.\n     */\n    protected function _assertRequestNotJson(): void\n    {\n        if ($this->getRequest()->is('json')) {\n            throw new BadRequestException(__('This functionality is not available using AJAX/JSON.'));\n        }\n    }\n\n    /**\n     * Assert the request is of json type.\n     *\n     * @return void\n     * @throw BadRequestException if the request is not of json type.\n     */\n    protected function _assertRequestIsJson(): void\n    {\n        if (!$this->getRequest()->is('json')) {\n            throw new BadRequestException(__('This functionality is only available using AJAX/JSON.'));\n        }\n    }\n}\n","sourceCodeStart":78,"sourceCodeEnd":100,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaController.php#L78-L100","documentation":"The JSON MFA API endpoints only accept AJAX/JSON requests. _assertRequestIsJson rejects any request not flagged as JSON (e.g. missing .json extension or JSON Accept header) with a BadRequestException, ensuring the response is machine-readable for API clients.","triggerScenarios":"GET/POST to the JSON MFA endpoints without the .json URL extension or without Content-Type/Accept: application/json.","commonSituations":"Hitting the endpoint in a browser address bar; scripts forgetting the .json suffix used by Passbolt's CakePHP JSON view routing.","solutions":["Append .json to the endpoint URL","Send Accept: application/json (and appropriate Content-Type for POST)","Use the browser (non-JSON) flow for interactive MFA"],"exampleFix":"// before\nawait fetch('/mfa/verify/verify', {method:'POST'});\n// after\nawait fetch('/mfa/verify/verify.json', {method:'POST', headers:{'Content-Type':'application/json'}});","handlingStrategy":"validation","validationCode":"if (!url.endsWith('.json')) url += '.json';\nheaders['Accept'] = 'application/json';","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always suffix Passbolt API calls with .json for API endpoints","Use a shared HTTP wrapper that enforces JSON headers","Test endpoints with curl -H 'Accept: application/json'"],"tags":["mfa","http-400","ajax","request-format"],"backgroundTag":"invalid-argument-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}