{"record":{"id":"c79645df32992398","repo":"passbolt/passbolt_api","slug":"the-scim-setting-identifier-should-be-a-valid-uuid","errorCode":null,"errorMessage":"The SCIM setting identifier should be a valid UUID.","messagePattern":"The SCIM setting identifier should be a valid UUID\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Service/ScimSetSettingsService.php","lineNumber":63,"sourceCode":"\n    public const SCIM_SETTINGS_UPDATE_EVENT_NAME = 'scim_settings_update_event_name';\n\n    /**\n     * @param \\App\\Utility\\UserAccessControl $uac\n     * @param array $data\n     * @param string|null $id\n     * @return array\n     * @throws \\Exception\n     */\n    public function saveSettings(UserAccessControl $uac, array $data, ?string $id = null): array\n    {\n        // Capture the raw plaintext token before form hashes it with bcrypt\n        $rawSecretToken = $data['secret_token'] ?? null;\n\n        $form = new ScimSettingsForm();\n        if ($id) {\n            if (!Validation::uuid($id)) {\n                throw new BadRequestException(__('The SCIM setting identifier should be a valid UUID.'));\n            }\n            $data['id'] = $id;\n        }\n\n        // Using this approach to avoid checking for setting_id duplicates on update\n        $validate = $id ? 'update' : 'extended';\n        if (!$form->execute($data, ['validate' => $validate])) {\n            throw new FormValidationException(\n                __('Could not validate the SCIM settings.'),\n                $form\n            );\n        }\n\n        /** @var \\Passbolt\\Scim\\Model\\Table\\ScimSettingsTable $scimSettingsTable */\n        $scimSettingsTable = $this->fetchTable('Passbolt/Scim.ScimSettings');\n        /** @var \\Passbolt\\Scim\\Model\\Entity\\ScimSetting|null $current */\n        $current = $scimSettingsTable->find()->first();\n        if (!$current && $id) {","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Service/ScimSetSettingsService.php#L45-L81","documentation":"ScimSetSettingsService::saveSettings() validates the optional $id path parameter with Cake's Validation::uuid() before using it. When updating settings, the URL is expected to be /scim-settings/<uuid>; a non-UUID id means the client is calling PUT with a malformed identifier, so a 400 BadRequestException is thrown.","triggerScenarios":"PUT /scim-settings/<id> where <id> is not a valid UUID (empty string is falsy and skips the check, but any other malformed value like a slug, numeric id, or truncated uuid triggers it).","commonSituations":"API client constructing the update URL from a wrong field, hardcoding an id placeholder, or sending a name/slug instead of the settings row UUID; also script errors concatenating the base URL with a partial id.","solutions":["Pass a valid RFC 4122 UUID in the URL; fetch the current settings id first with GET /scim-settings and use its `id` field.","If the intent was to CREATE settings, call POST /scim-settings without an id rather than PUT with a bogus id.","Fix the client-side URL template so it interpolates the real id, e.g. `/scim-settings/${settings.id}`."],"exampleFix":"// before\nfetch('/scim-settings/1', {method:'PUT', ...});\n// after\nconst settings = await (await fetch('/scim-settings.json')).json();\nfetch(`/scim-settings/${settings.id}`, {method:'PUT', ...});","handlingStrategy":"validation","validationCode":"if (id && !/^\\d{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id)) {\n  throw new Error('SCIM settings id must be a UUID, got: ' + id);\n}","typeGuard":"const isUuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);","tryCatchPattern":"try {\n  await api.put(`/scim-settings/${id}.json`, payload);\n} catch (e) {\n  if (e.response?.status === 400) { /* re-fetch settings id and retry as create/update */ }\n}","preventionTips":["Always fetch the id from GET /scim-settings instead of storing/copying it.","Validate UUIDs client-side before building PUT URLs.","Use POST (no id) for creation paths."],"tags":["scim","php","uuid","bad-request"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}