{"record":{"id":"ce653143ff010661","repo":"flowable/flowable-engine","slug":"userid-is-null-ce6531","errorCode":null,"errorMessage":"userId is null","messagePattern":"userId is null","errorType":"validation","errorClass":"FlowableIllegalArgumentException","httpStatus":400,"severity":"error","filePath":"modules/flowable-idm-engine/src/main/java/org/flowable/idm/engine/impl/cmd/DeleteUserCmd.java","lineNumber":37,"sourceCode":"import org.flowable.common.engine.impl.interceptor.CommandContext;\nimport org.flowable.idm.engine.impl.util.CommandContextUtil;\n\n/**\n * @author Tom Baeyens\n */\npublic class DeleteUserCmd implements Command<Void>, Serializable {\n\n    private static final long serialVersionUID = 1L;\n    String userId;\n\n    public DeleteUserCmd(String userId) {\n        this.userId = userId;\n    }\n\n    @Override\n    public Void execute(CommandContext commandContext) {\n        if (userId == null) {\n            throw new FlowableIllegalArgumentException(\"userId is null\");\n        }\n        CommandContextUtil.getUserEntityManager(commandContext).delete(userId);\n\n        return null;\n    }\n}\n","sourceCodeStart":19,"sourceCodeEnd":44,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-idm-engine/src/main/java/org/flowable/idm/engine/impl/cmd/DeleteUserCmd.java#L19-L44","documentation":"DeleteUserCmd.execute() verifies userId is non-null before calling the UserEntityManager's delete. Deleting a user without an identifier is meaningless, so the engine throws FlowableIllegalArgumentException.","triggerScenarios":"Calling IdentityService.deleteUser(null) or executing new DeleteUserCmd(null), e.g. during user-provisioning cleanup where the id came from an unset variable or failed lookup.","commonSituations":"User-deletion flows triggered by SCIM/LDAP sync events with missing ids; REST DELETE endpoints with a null path variable after framework coercion; scripts deleting test users whose id was renamed.","solutions":["Pass a non-null userId to IdentityService.deleteUser().","Confirm the user exists (createUserQuery().userId(id).singleResult()) before deleting.","Filter null ids out of bulk-deletion loops before invoking the engine.","Catch FlowableIllegalArgumentException and convert to a domain validation error."],"exampleFix":"// before\nidentityService.deleteUser(userId); // userId may be null\n\n// after\nObjects.requireNonNull(userId, \"userId is required\");\nidentityService.deleteUser(userId);","handlingStrategy":"validation","validationCode":"if (userId == null || userId.isEmpty()) {\n    throw new IllegalArgumentException(\"userId must be provided before deleting a user\");\n}","typeGuard":"boolean hasValidUserId(String userId) {\n    return userId != null && !userId.isEmpty();\n}","tryCatchPattern":"try {\n    identityService.deleteUser(userId);\n} catch (FlowableIllegalArgumentException e) {\n    if (e.getMessage().contains(\"userId is null\")) {\n        throw new InvalidRequestException(\"User id must not be null\");\n    }\n    throw e;\n}","preventionTips":["Confirm the user exists before deletion to separate not-found from invalid-input cases.","Sanitize sync/SCIM events: skip records without ids instead of forwarding nulls.","Guard DELETE endpoints against null path variables.","Use Objects.requireNonNull at call sites for early, descriptive failures."],"tags":["flowable","idm","null-check","user"],"backgroundTag":"null-argument","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T16:30:33.424Z"}