{"record":{"id":"edccb9d1c9ade256","repo":"passbolt/passbolt_api","slug":"the-request-id-is-invalid-accountrecoveryrequestgetservice","errorCode":null,"errorMessage":"The request id is invalid.","messagePattern":"The request id is invalid\\.","errorType":"http","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryRequests/AccountRecoveryRequestGetService.php","lineNumber":157,"sourceCode":"        string $token,\n        ?string $clientIp = null\n    ): AccountRecoveryRequest {\n        // Assert policy is not set to disabled\n        (new AccountRecoveryOrganizationPolicyGetService())->getOrFail();\n\n        // Assert token exist and is valid and belong to the user and is of the right type\n        $tokenService = new AuthenticationTokenGetService();\n        $tokenEntity = $tokenService->getActiveOrFail($token, $userId, AuthenticationToken::TYPE_RECOVER);\n\n        // Assert user exist, is active and not deleted\n        $userEntity = (new UserGetService())->getActiveNotDeletedNotDisabledOrFail($userId);\n\n        // Assert user is enrolled in the program\n        (new AccountRecoveryUserSettingsGetService())->getOrFail($userId);\n\n        // Assert request entity exist and belong to the user\n        if (!Validation::uuid($requestId)) {\n            throw new BadRequestException(__('The request id is invalid.'));\n        }\n        try {\n            $where = [\n                'id' => $requestId,\n                'user_id' => $userEntity->id,\n                'authentication_token_id' => $tokenEntity->id,\n            ];\n            /** @var \\Passbolt\\AccountRecovery\\Model\\Entity\\AccountRecoveryRequest $requestEntity */\n            $requestEntity = $this->AccountRecoveryRequests->find()->where($where)->firstOrFail();\n        } catch (RecordNotFoundException $exception) {\n            $this->onRequestDoesNotExist($requestId, $userId, $clientIp ?? '0.0.0.0');\n            throw new NotFoundException(__('The account recovery request could not be found.'));\n        }\n\n        // Assert request is not already completed\n        if ($requestEntity->isCompleted()) {\n            throw new BadRequestException(__('The request is already completed.'));\n        }","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryRequests/AccountRecoveryRequestGetService.php#L139-L175","documentation":"Validation guard while fetching an account recovery request: the request id derived from the flow does not pass the uuid/validity checks after token and user assertions, so the recovery request identifier is invalid and the get fails.","triggerScenarios":"Calling getNotCompletedOrFail()/get() (GET /account-recovery/requests/{id}) with an id that fails Validation::uuid(): missing, empty, numeric, or malformed string.","commonSituations":"Route parameter not populated (wrong route template); client concatenates URL incorrectly; passing an internal numeric id instead of the request UUID.","solutions":["Pass the account recovery request's UUID as the route id","Log/inspect the request id on the client before calling the endpoint","Confirm the route pattern captures the id segment correctly"],"exampleFix":"// before\nGET /account-recovery/requests/123\n// after\nGET /account-recovery/requests/6d3c4d99-7c1f-4d3e-8b76-0a3f9d2c1a55","handlingStrategy":"validation","validationCode":"if (!Validation::uuid($requestId)) { // do not call the endpoint; fix the id source first }","typeGuard":"function isUuid(?string $v): bool { return is_string($v) && (bool)preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $v); }","tryCatchPattern":"try { $service->get($requestId, $userId, $token); } catch (BadRequestException $e) { if (str_contains($e->getMessage(), 'request id is invalid')) { fixRouteOrIdSource(); } }","preventionTips":["Take the request id from the create response or route parameters, not free-form input","Verify the client route template actually captures the {id} segment","Validate UUID format before sending"],"tags":["validation","uuid","bad-request","account-recovery"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}