{"record":{"id":"a82dfbd7814967d7","repo":"zaproxy/zaproxy","slug":"bad-format","errorCode":"BAD_FORMAT","errorMessage":"The format OTHER should not be used with views and actions.","messagePattern":"The format OTHER should not be used with views and actions\\.","errorType":"error_code","errorClass":"ApiException","httpStatus":null,"severity":"error","filePath":"zap/src/main/java/org/zaproxy/zap/extension/api/API.java","lineNumber":732,"sourceCode":"        }\n    }\n\n    /**\n     * Validates that the given format is supported for views and actions.\n     *\n     * @param format the format to validate.\n     * @throws ApiException if the format is not valid.\n     * @see #convertViewActionApiResponse(Format, String, ApiResponse)\n     */\n    private static void validateFormatForViewAction(Format format) throws ApiException {\n        switch (format) {\n            case JSON:\n            case JSONP:\n            case XML:\n            case HTML:\n                return;\n            default:\n                throw new ApiException(\n                        ApiException.Type.BAD_FORMAT,\n                        \"The format OTHER should not be used with views and actions.\");\n        }\n    }\n\n    /**\n     * Returns a URI for the specified parameters.\n     *\n     * <p>An {@link #getOneTimeNonce(String) one time nonce query parameter} is added to the\n     * resulting URL, if required (that is, not a view). In this case the URL is ended with an\n     * ampersand (for example, {@code https://zap/format/prefix/action/name/?apinonce=xyz&}),\n     * otherwise it has a trailing slash (for example, {@code http://zap/format/prefix/view/name/}).\n     *\n     * @param format the format of the API response\n     * @param prefix the prefix of the API implementor\n     * @param type the request type\n     * @param name the name of the endpoint\n     * @param proxy if true then the URI returned will only work if proxying via ZAP, i.e. it will","sourceCodeStart":714,"sourceCodeEnd":750,"githubUrl":"https://github.com/zaproxy/zaproxy/blob/9d1970a436b1b189bfb588fc88864c80d9baf6a5/zap/src/main/java/org/zaproxy/zap/extension/api/API.java#L714-L750","documentation":"validateFormatForViewAction enforces that views and actions only support JSON, JSONP, XML, and HTML formats. If the request's format resolves to OTHER (or any other non-view format), it throws ApiException(Type.BAD_FORMAT) with message 'The format OTHER should not be used with views and actions.' Format OTHER is reserved for handlers that don't map to the standard renderers.","triggerScenarios":"Calling any /JSON/... or /XML/... view or action endpoint with format=OTHER (or an invalid format string that defaults to OTHER), e.g. GET /JSON/core/view/version/?format=OTHER.","commonSituations":"Clients copying a format parameter from a different endpoint type; scripts with a corrupted/typo'd format value that the parser coerces to OTHER; templated request generators leaving a placeholder format value.","solutions":["Remove the format parameter entirely (views/actions default to the endpoint's format implied by the path prefix) or set it to json, xml, html, or jsonp.","Use /OTHER/... endpoints only for handlers explicitly registered for the OTHER format, not for views/actions.","Fix URL templating so a literal/placeholder format value isn't sent.","Validate format at the client side against the allowed set {JSON, JSONP, XML, HTML} before calling."],"exampleFix":"// before\ncurl 'http://localhost:8080/JSON/core/view/version/?format=OTHER'\n// after\ncurl 'http://localhost:8080/JSON/core/view/version/?format=json'","handlingStrategy":"validation","validationCode":"const ALLOWED = new Set(['JSON','JSONP','XML','HTML']);\nif ('format' in params && !ALLOWED.has(params.format.toUpperCase())) {\n  throw new Error(`format must be one of ${[...ALLOWED]} for views/actions`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await zap.view(name, { format });\n} catch (e) {\n  if (e.code === 'BAD_FORMAT') {\n    return zap.view(name, { format: 'JSON' }); // drop/normalize the format\n  }\n  throw e;\n}","preventionTips":["Omit the format param unless you specifically need a non-default renderer.","Never pass format=OTHER to /JSON/,/XML/,/HTML/ view or action paths.","Whitelist formats in any URL builder that interpolates format.","Test clients after template changes that affect query params."],"tags":["zap","api","bad-format","validation"],"backgroundTag":"unsupported-format-parameter","analyzedSha":"9d1970a436b1b189bfb588fc88864c80d9baf6a5","analyzedAt":"2026-09-05T19:26:59.356Z","contentChangedAt":"2026-09-05T19:26:59.356Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}