{"record":{"id":"eeb71b9793372eff","repo":"passbolt/passbolt_api","slug":"the-user-identifier-should-be-a-valid-uuid-eeb71b","errorCode":null,"errorMessage":"The user identifier should be a valid UUID.","messagePattern":"The user identifier should be a valid UUID\\.","errorType":"http","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryRequests/AccountRecoveryRequestCreateService.php","lineNumber":133,"sourceCode":"    public function assertPolicyIsEnabled(): void\n    {\n        $service = new AccountRecoveryOrganizationPolicyGetService();\n        $policy = $service->get();\n        if ($policy->isDisabled()) {\n            $msg = __('Recovery request cannot be created when organization policy is disabled.');\n            throw new BadRequestException($msg);\n        }\n    }\n\n    /**\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if user id is not valid\n     * @return string uuid\n     */\n    public function assertUserId(): string\n    {\n        $userId = $this->getData('user_id');\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user identifier should be a valid UUID.'));\n        }\n\n        return $userId;\n    }\n\n    /**\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if organization policy is disabled\n     * @return void\n     */\n    public function assertUserIsEnrolled(): void\n    {\n        $service = new AccountRecoveryUserSettingsGetService();\n        $userSettings = $service->get($this->getData('user_id'));\n        if (!isset($userSettings) || $userSettings->isRejected()) {\n            $msg = __('Recovery request cannot be created when user is not enrolled.');\n            throw new BadRequestException($msg);\n        }\n    }","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryRequests/AccountRecoveryRequestCreateService.php#L115-L151","documentation":"BadRequestException thrown by AccountRecoveryRequestCreateService::assertUserId when the `user_id` field submitted in an account recovery request creation is not a valid UUID. It is a first-line input validation so that malformed identifiers never reach the database layer.","triggerScenarios":"POST to /account-recovery/requests (via AccountRecoveryRequestCreateService::create) with a `user_id` that is missing, empty, an integer, or any string that fails CakePHP Validation::uuid().","commonSituations":"Client sends the username/email instead of the user UUID; a truncated or URL-decoded id; an older client API version posting a different payload shape; manual API testing with an arbitrary string.","solutions":["Send a valid UUID in `user_id` (36-char, 8-4-4-4-12 format)","Look up the user's id first, e.g. via the users API by username","Check the client version/payload serialization matches the passbolt API schema"],"exampleFix":"// before\nPOST {\"user_id\": \"ada@example.com\"}\n// after\nPOST {\"user_id\": \"54c3d2ae-1d10-46c8-a7f1-1a25dc5b079c\"}","handlingStrategy":"validation","validationCode":"if (!preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $userId)) { throw new \\InvalidArgumentException('user_id must be a UUID'); }","typeGuard":"function isUuid(?string $v): bool { return is_string($v) && (bool)preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $v); }","tryCatchPattern":"try { $service->create($data); } catch (BadRequestException $e) { if ($e->getMessage() contains 'valid UUID') { correctPayload(); } }","preventionTips":["Resolve user_id from a server lookup (by email/username), never from user input","Validate UUIDs client-side before sending","Keep client payload schemas in sync with the passbolt API version"],"tags":["validation","uuid","bad-request","account-recovery"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}