{"record":{"id":"caaf531d1d3714cc","repo":"Mintplex-Labs/anything-llm","slug":"bad-request-caaf53","errorCode":null,"errorMessage":"Bad Request","messagePattern":"Bad Request","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"server/endpoints/system.js","lineNumber":1080,"sourceCode":"        response.status(500).json({\n          apiKey: null,\n          error: \"Error generating api key.\",\n        });\n      }\n    }\n  );\n\n  // TODO: This endpoint is replicated in the admin endpoints file.\n  // and should be consolidated to be a single endpoint with flexible role protection.\n  app.delete(\n    \"/system/api-key/:id\",\n    [validatedRequest],\n    async (request, response) => {\n      try {\n        if (response.locals.multiUserMode)\n          return response.sendStatus(401).end();\n        const { id } = request.params;\n        if (!id || isNaN(Number(id))) return response.sendStatus(400).end();\n\n        await ApiKey.delete({ id: Number(id) });\n        await EventLogs.logEvent(\n          \"api_key_deleted\",\n          { deletedBy: response.locals?.user?.username },\n          response?.locals?.user?.id\n        );\n        return response.status(200).end();\n      } catch (error) {\n        console.error(error);\n        response.status(500).end();\n      }\n    }\n  );\n\n  app.post(\n    \"/system/custom-models\",\n    [validatedRequest, flexUserRoleValid([ROLES.admin])],","sourceCodeStart":1062,"sourceCodeEnd":1098,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/server/endpoints/system.js#L1062-L1098","documentation":"Returned by DELETE /system/api-key/:id when the `:id` URL parameter is missing, empty, or non-numeric. Line 1079-1080 extracts `const { id } = request.params` then checks `if (!id || isNaN(Number(id))) return response.sendStatus(400).end()`. The ApiKey model's delete method requires `Number(id)` — a numeric primary key — so non-numeric values are rejected before reaching the database layer.","triggerScenarios":"The URL path segment for :id is a non-numeric string (e.g. /system/api-key/abc), an empty string, or a UUID. Calling the route without the parameter (some Express routers may allow /system/api-key/ to match with an empty capture) also triggers it.","commonSituations":"Client code passes a string identifier (UUID, slug) instead of the numeric database row ID. URL construction bug leaves the ID as a literal placeholder like ':id' or undefined. A frontend table row uses the wrong field (e.g., a hash instead of the numeric id column) when building the delete URL.","solutions":["Ensure the :id path parameter is the numeric primary key from the api_keys table, as returned by the GET /system/api-keys listing endpoint.","Add a client-side validation that the ID is a positive integer before constructing the request URL.","Check the frontend API call for template-literal interpolation bugs (e.g., `${apiKey.id}` resolving to undefined).","Inspect the network tab to confirm the actual URL being sent — the :id segment may be empty or contain a non-numeric value."],"exampleFix":"// before\nconst id = apiKey.uuid; // wrong field\nawait fetch(`/system/api-key/${id}`, { method: 'DELETE' });\n\n// after\nconst id = apiKey.id; // numeric primary key\nif (!id || isNaN(Number(id))) throw new Error('Invalid API key ID');\nawait fetch(`/system/api-key/${id}`, { method: 'DELETE' });","handlingStrategy":"validation","validationCode":"function isValidApiKeyId(id) {\n  const num = Number(id);\n  return id != null && id !== '' && !isNaN(num) && num > 0;\n}\n\n// Usage before the request\nif (!isValidApiKeyId(apiKey.id)) {\n  throw new Error(`Invalid API key ID: ${apiKey.id}. Must be a positive integer.`);\n}","typeGuard":"function isNumericId(value) {\n  return typeof value === 'number' && Number.isInteger(value) && value > 0\n    || (typeof value === 'string' && /^\\d+$/.test(value) && Number(value) > 0);\n}","tryCatchPattern":null,"preventionTips":["Always use the numeric `id` field from the API key listing response, never a UUID or slug.","Add client-side validation that the ID is a positive integer before constructing the URL.","Watch for template-literal bugs where undefined is interpolated into the URL path."],"tags":["validation","api-key","input-validation","bad-request"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}