{"record":{"id":"cd0896d2b91d8b7a","repo":"ory/kratos","slug":"the-wildcard-is-not-accepted-here","errorCode":null,"errorMessage":"the wildcard '*' is not accepted here","messagePattern":"the wildcard '\\*' is not accepted here","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"session/handler.go","lineNumber":1399,"sourceCode":"\t}\n\tids, err = parseManageSessionsIDs(raw)\n\treturn ids, false, err\n}\n\n// parseManageSessionsIDs interprets a manage-sessions filter array as a list\n// of explicit UUIDs and rejects any input containing the wildcard token.\n// Callers that accept the wildcard must use parseManageSessionsIDsOrWildcard.\nfunc parseManageSessionsIDs(raw []string) ([]uuid.UUID, error) {\n\tif len(raw) == 0 {\n\t\treturn nil, errors.New(\"array must not be empty\")\n\t}\n\tif len(raw) > ManageSessionsMaxIDs {\n\t\treturn nil, fmt.Errorf(\"at most %d IDs may be provided per call\", ManageSessionsMaxIDs)\n\t}\n\tids := make([]uuid.UUID, 0, len(raw))\n\tfor _, s := range raw {\n\t\tif s == ManageSessionsAllToken {\n\t\t\treturn nil, errors.New(\"the wildcard '*' is not accepted here\")\n\t\t}\n\t\tid, err := uuid.FromString(s)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not parse %q as UUID: %w\", s, err)\n\t\t}\n\t\tids = append(ids, id)\n\t}\n\treturn ids, nil\n}\n\n// wildcardBatch runs a single chunked bulk-session operation and packages the\n// row count plus a `more` flag for the response. `more` is true when the call\n// reached the per-call batch limit, signaling that the caller should re-issue\n// the request to drain the rest.\n//\n// When the row count is an exact multiple of the batch size, `more` is set\n// even though no rows are left; the caller will issue one extra request that\n// returns `{processed: 0, more: false}`. This is intentional — distinguishing","sourceCodeStart":1381,"sourceCodeEnd":1417,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/session/handler.go#L1381-L1417","documentation":"parseManageSessionsIDs rejects the wildcard token '*' in the explicit-ID variant of the manage-sessions filter. The wildcard is only meaningful in parseManageSessionsIDsOrWildcard; passing it here is treated as a misuse because the caller explicitly wants concrete UUIDs.","triggerScenarios":"Sending \"ids\": [\"*\"] to an admin session endpoint that only accepts explicit session UUIDs.","commonSituations":"Frontend reuses the same 'select all' code path for both wildcard and explicit endpoints; copy-pasting a curl example from the wildcard API into the explicit-ID API.","solutions":["Send explicit session UUIDs instead of '*' to this endpoint","Use the wildcard-enabled endpoint (the one using parseManageSessionsIDsOrWildcard) when you intend to match all sessions","Fix the client to distinguish 'select all' (wildcard endpoint) from 'select these' (UUID list)"],"exampleFix":"// before\nPOST /admin/sessions/... {\"ids\": [\"*\"]}\n// after\nPOST /admin/sessions/... {\"ids\": [\"6d0e5a3d-1c2e-4f5a-...\",\"9b2f...\"]}\n// or use the wildcard endpoint for all sessions","handlingStrategy":"validation","validationCode":"if (ids.includes(\"*\")) { switch to wildcard-accepting endpoint } ","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the wildcard endpoint for select-all; UUID list endpoint otherwise","Never send \"*\" mixed into or as a UUID list","Centralize session-API request builders to avoid mixing modes"],"tags":["go","http-api","session","admin"],"backgroundTag":"invalid-argument-value","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}