{"record":{"id":"c33225d3e440cf40","repo":"payloadcms/payload","slug":"missing-where-query-of-documents-to-update","errorCode":null,"errorMessage":"Missing 'where' query of documents to update.","messagePattern":"Missing 'where' query of documents to update\\.","errorType":"http","errorClass":"APIError","httpStatus":400,"severity":"error","filePath":"packages/payload/src/collections/operations/update.ts","lineNumber":122,"sourceCode":"      populate,\n      publishAllLocales,\n      req: {\n        fallbackLocale,\n        locale,\n        payload: { config },\n        payload,\n      },\n      req,\n      select: incomingSelect,\n      showHiddenFields,\n      sort: incomingSort,\n      trash = false,\n      unpublishAllLocales,\n      where,\n    } = args\n\n    if (!where) {\n      throw new APIError(\"Missing 'where' query of documents to update.\", httpStatus.BAD_REQUEST)\n    }\n\n    const { data: bulkUpdateData } = args\n    const shouldSaveDraft = Boolean(draftArg && hasDraftsEnabled(collectionConfig))\n\n    // /////////////////////////////////////\n    // Access\n    // /////////////////////////////////////\n\n    let accessResult: AccessResult\n    if (!overrideAccess) {\n      accessResult = await executeAccess(\n        { slug: collectionConfig.slug, req },\n        collectionConfig.access.update,\n      )\n    }\n\n    await validateQueryPaths({","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/collections/operations/update.ts#L104-L140","documentation":"Thrown at packages/payload/src/collections/operations/update.ts:122 with HTTP 400 (BAD_REQUEST) inside `updateOperation` when the `where` argument is falsy. Because this is the bulk-update path, Payload requires a `where` clause to scope which documents change; omitting it would otherwise update every document. The guard runs after beforeOperation hooks and the disableBulkEdit check, before access control.","triggerScenarios":"Calling `payload.update({ collection, data })` in the many-doc form without a `where` field; destructuring `where` from a request body where the client omitted it; a refactor that dropped the where clause assuming an empty filter means 'all'.","commonSituations":"Confusing the single-doc update signature (`{ collection, id, data }`) with the bulk signature (`{ collection, where, data }`); client sends a PUT/PATCH body without a filter; migration script that forgot the where clause.","solutions":["Provide an explicit `where` clause to scope the update.","If you truly mean 'update a single document', use the id-based form: `payload.update({ collection, id, data })`.","Validate at the API boundary that `where` is present before forwarding to the bulk Local API."],"exampleFix":"// before — bulk update without a where clause\nawait payload.update({ collection: 'posts', data: { status: 'published' } })\n\n// after — scope the update explicitly\nawait payload.update({ collection: 'posts', where: { status: { equals: 'draft' } }, data: { status: 'published' } })\n// or update a single document by id\nawait payload.update({ collection: 'posts', id, data: { status: 'published' } })","handlingStrategy":"validation","validationCode":"function assertWhereClause(where: unknown): asserts where is NonNullable<Where> {\n  if (!where || (typeof where === 'object' && Object.keys(where).length === 0)) {\n    throw new Error('A non-empty where clause is required for bulk update.')\n  }\n}\n\nassertWhereClause(where)\nawait payload.update({ collection: 'posts', where, data })\n// if you only mean to update one doc, use: payload.update({ collection: 'posts', id, data })","typeGuard":"import type { Where } from 'payload'\n\nconst hasWhereClause = (where: unknown): where is Where =>\n  typeof where === 'object' && where !== null && Object.keys(where).length > 0\n\nif (hasWhereClause(where)) {\n  await payload.update({ collection: 'posts', where, data })\n} else if (id) {\n  await payload.update({ collection: 'posts', id, data })\n} else {\n  // reject: neither a where clause nor an id was provided\n}","tryCatchPattern":"try {\n  await payload.update({ collection: 'posts', where, data })\n} catch (err) {\n  if (err instanceof APIError && err.status === 400 && /Missing 'where' query/.test(err.message)) {\n    // caller forgot the where clause — require it, or switch to single-doc update\n  } else throw err\n}","preventionTips":["Validate at the API boundary that bulk-update requests include a non-empty where clause.","Use the single-doc update form ({ collection, id, data }) when targeting one document.","Never default an absent where clause to {} (empty), since bulk update without a filter is almost never intended."],"tags":["local-api","update","validation","where-query","bad-request"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}