{"record":{"id":"85d3ab143b3d1a05","repo":"passbolt/passbolt_api","slug":"the-resource-identifier-should-be-a-valid-uuid-85d3ab","errorCode":null,"errorMessage":"The resource identifier should be a valid UUID.","messagePattern":"The resource identifier should be a valid UUID\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Controller/Resources/ResourcesDeleteController.php","lineNumber":81,"sourceCode":"    /**\n     * Resource Delete action\n     *\n     * @param string $id The identifier of the resource to delete.\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If the resource does not exist.\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If the resource is soft deleted.\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If the user does not have access to the resource.\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException If the user does not have the permission to delete the resource.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException If the resource id is not a valid uuid.\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if the resource could not be saved for other reasons\n     * @return void\n     */\n    public function delete(string $id): void\n    {\n        $this->assertJson();\n\n        // Check request sanity\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The resource identifier should be a valid UUID.'));\n        }\n\n        // Retrieve the resource to delete.\n        try {\n            /** @var \\App\\Model\\Entity\\Resource $resource */\n            $resource = $this->Resources->find()\n                ->contain(['ResourceTypes'])\n                ->where(['Resources.id' => $id])\n                ->firstOrFail();\n            $originalResource = clone $resource;\n        } catch (RecordNotFoundException $e) {\n            throw new NotFoundException(__('The resource does not exist.'));\n        }\n\n        // Get the list of users who have access to the resource\n        // useful to do now to notify users later, since it wont be possible to after delete\n        // The logged in user will not be notified.\n        $options = ['contain' => ['role'], 'filter' => ['has-access' => [$resource->id]]];","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Resources/ResourcesDeleteController.php#L63-L99","documentation":"Passbolt throws this 400 when the DELETE /resources/<id> path parameter is not a valid UUID. ResourcesDeleteController::delete validates with Validation::uuid() before attempting to load the resource.","triggerScenarios":"DELETE /resources/<id>.json with numeric/slug/empty/truncated id segments from malformed client calls or legacy id schemes.","commonSituations":"Scripts iterating over a list where a name or index was passed instead of the id; string slicing bugs; older integrations built for numeric ids; double URL-encoding corrupting the UUID.","solutions":["Fetch the resource UUID from GET /resources.json and retry DELETE with it","Add a UUID format check before issuing the DELETE","Fix client code to pass the entity's id property, not name/slug","Check for URL-encoding or truncation issues if the id appears correct in source"],"exampleFix":"// before\nawait api.del(`/resources/${row.name}.json`);\n// after\nif (!/^[0-9a-f-]{36}$/i.test(row.id)) throw new Error('invalid resource id');\nawait api.del(`/resources/${row.id}.json`);","handlingStrategy":"validation","validationCode":"const isUuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);\nif (!isUuid(resourceId)) throw new Error('delete requires a resource UUID');","typeGuard":"const deletable = (r) => isUuid(r?.id) && r.personal === false ? r.id : null;","tryCatchPattern":"if (!isUuid(id)) { id = await lookupIdFromIndex(name); }","preventionTips":["Fetch ids from the resources index before destructive calls","Add a dry-run/list step in deletion scripts","Sanitize variables interpolated into DELETE URLs"],"tags":["http-400","uuid","validation","resources"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}