{"record":{"id":"8345330c1bdfb235","repo":"Mintplex-Labs/anything-llm","slug":"bad-request","errorCode":null,"errorMessage":"Bad Request","messagePattern":"Bad Request","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"server/endpoints/admin.js","lineNumber":549,"sourceCode":"        );\n        return response.status(200).json({\n          apiKey,\n          error,\n        });\n      } catch (e) {\n        console.error(e);\n        response.sendStatus(500).end();\n      }\n    }\n  );\n\n  app.delete(\n    \"/admin/delete-api-key/:id\",\n    [validatedRequest, strictMultiUserRoleValid([ROLES.admin])],\n    async (request, response) => {\n      try {\n        const { id } = request.params;\n        if (!id || isNaN(Number(id))) return response.sendStatus(400).end();\n        await ApiKey.delete({ id: Number(id) });\n\n        await EventLogs.logEvent(\n          \"api_key_deleted\",\n          { deletedBy: response.locals?.user?.username },\n          response?.locals?.user?.id\n        );\n        return response.status(200).end();\n      } catch (e) {\n        console.error(e);\n        response.sendStatus(500).end();\n      }\n    }\n  );\n}\n\nmodule.exports = { adminEndpoints };\n","sourceCodeStart":531,"sourceCodeEnd":567,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/server/endpoints/admin.js#L531-L567","documentation":"DELETE /admin/delete-api-key/:id (server/endpoints/admin.js:543) returns HTTP 400 via `return response.sendStatus(400).end()` at line 549 when `!id || isNaN(Number(id))` is true. This is an explicit, intentional client-error response, not an exception. It fires when the path parameter is missing, empty, or not parseable as a finite number.","triggerScenarios":"DELETE /admin/delete-api-key/ (empty id); DELETE /admin/delete-api-key/abc (non-numeric); DELETE /admin/delete-api-key/undefined (the literal string 'undefined' coming from a JS client that stringified undefined into the URL).","commonSituations":"Frontend building the URL from a possibly-undefined variable; a malformed route in an integration test; a user editing the URL by hand.","solutions":["On the client, ensure the id is a defined number before constructing the URL.","Treat 400 as a programming error — log it on the client and do not auto-retry.","If calling from a script, coerce the id with Number() and skip the call when NaN.","Confirm the front-end is using the api key's numeric primary key, not its secret string."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const id = Number(request.params.id);\nif (!Number.isInteger(id) || id <= 0) {\n  return response.status(400).json({ success:false, error:'Invalid api key id' });\n}","typeGuard":"/** @param {unknown} v */\nfunction isApiKeyId(v) {\n  const n = Number(v);\n  return typeof v !== 'undefined' && v !== '' && !isNaN(n) && Number.isInteger(n) && n > 0;\n}","tryCatchPattern":null,"preventionTips":["On the client, coerce the api key id with Number() and skip the call when NaN.","Use the numeric primary key, never the secret string, in the URL.","Treat 400 as a programming error and log it client-side rather than retrying."],"tags":["express","admin-api","api-keys","input-validation","client-error"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}