{"record":{"id":"bcd732e62f4cd937","repo":"passbolt/passbolt_api","slug":"the-metadata-key-id-should-be-a-valid-uuid-bcd732","errorCode":null,"errorMessage":"The metadata key ID should be a valid UUID.","messagePattern":"The metadata key ID should be a valid UUID\\.","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Controller/MetadataKeyUpdateController.php","lineNumber":46,"sourceCode":"{\n    /**\n     * Update a given metadata key,\n     * Used only to mark keys as expired\n     *\n     * @param string $id key uuid\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the key does not exist or is already expired\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the key format is invalid or some conditions are not met\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if there was an issue during the save/delete\n     */\n    public function update(string $id): void\n    {\n        $this->assertJson();\n        $this->User->assertIsAdmin();\n        $this->assertNotEmptyArrayData();\n\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The metadata key ID should be a valid UUID.'));\n        }\n\n        $form = new MetadataKeyUpdateForm();\n        if (!$form->execute($this->getRequest()->getData())) {\n            throw new FormValidationException(__('Could not validate the metadata key data.'), $form);\n        }\n\n        $dto = MetadataKeyUpdateDto::fromArray($form->getData());\n        (new MetadataKeyUpdateService())->update($this->User->getAccessControl(), $id, $dto);\n        $this->success(__('The operation was successful.'));\n    }\n}\n","sourceCodeStart":28,"sourceCodeEnd":59,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Controller/MetadataKeyUpdateController.php#L28-L59","documentation":"Format guard in the metadata key update action (used to expire keys): the id route parameter does not pass Validation::uuid(), so the metadata key identifier is invalid and the request is rejected with 400.","triggerScenarios":"Metadata key update call where {id} is not a valid UUID string.","commonSituations":"Using a key fingerprint or resource id instead of the metadata key UUID; empty id from a templated URL; truncated identifiers in test scripts.","solutions":["Pass the metadata key UUID in the path.","Fetch GET /metadata/keys to resolve the correct UUID.","Add client-side UUID validation before issuing the request."],"exampleFix":"// before\nclient.updateMetadataKey(fingerprint, data);\n// after\nif (!isUuid(fingerprint)) throw new Error('id must be a UUID');\nclient.updateMetadataKey(keyId /* uuid */, data);","handlingStrategy":"validation","validationCode":"if (!isUuid(id)) throw new Error('id must be a UUID'); await api.put(`/metadata/keys/${id}`, body);","typeGuard":"function isUuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v); }","tryCatchPattern":"try { await api.put(`/metadata/keys/${id}`, body); } catch (e) { if (e.response?.status === 400 && String(e.message).includes('UUID')) { throw new ProgrammerError('use the metadata key UUID, not ' + id); } throw e; }","preventionTips":["Keep entity ids as opaque strings taken from API responses.","Validate route params before calling the API.","Distinguish metadata key ids from fingerprints in your data model."],"tags":["uuid","validation","api","bad-request"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}