{"record":{"id":"ef3815553833feed","repo":"passbolt/passbolt_api","slug":"the-identifier-should-be-a-valid-uuid-ef3815","errorCode":null,"errorMessage":"The identifier should be a valid UUID.","messagePattern":"The identifier should be a valid UUID\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Controller/Permissions/PermissionsViewController.php","lineNumber":69,"sourceCode":"\n    /**\n     * View permissions defined for an aco instance.\n     * Only support the entity Resource for now.\n     *\n     * @param string $acoForeignKey The target aco id.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException If the parameter acoForeignKey is null\n     * @throws \\Cake\\Http\\Exception\\BadRequestException If the parameter acoForeignKey is not a valid uuid\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If the target resource doesn't exist\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If the target resource is soft deleted\n     * @return void\n     */\n    public function viewAcoPermissions(string $acoForeignKey)\n    {\n        $this->assertJson();\n\n        // Check request sanity\n        if (!Validation::uuid($acoForeignKey)) {\n            throw new BadRequestException(__('The identifier should be a valid UUID.'));\n        }\n\n        // Retrieve and sanity the query options.\n        $whitelist = ['contain' => ['group', 'user', 'user.profile']];\n        $options = $this->QueryString->get($whitelist);\n\n        // Check that the user has access to the resource.\n        $resource = $this->Resources->findView($this->User->id(), $acoForeignKey)->first();\n        if (empty($resource)) {\n            throw new NotFoundException(__('The resource does not exist.'));\n        }\n\n        // Retrieve the permissions.\n        $permissions = $this->Permissions->findViewAcoPermissions($acoForeignKey, $options);\n        $this->success(__('The operation was successful.'), $permissions);\n    }\n}\n","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Permissions/PermissionsViewController.php#L51-L87","documentation":"Passbolt throws this 400 when the acoForeignKey path parameter of the permissions view endpoint is not a valid UUID. PermissionsViewController::viewAcoPermissions validates with Validation::uuid() before any lookup.","triggerScenarios":"GET /permissions/resource/<acoForeignKey>.json with a non-UUID identifier: numeric id, slug, empty string, or an id that got mangled/truncated in transit.","commonSituations":"Legacy integrations using integer resource ids; concatenating the wrong variable into the URL; a client parsing a display name instead of the id; URL encoding issues dropping characters.","solutions":["Ensure the path parameter is the resource's UUID obtained from GET /resources.json","Add client-side UUID validation before the request","Fix URL construction to interpolate the id field, not name or legacy numeric id","Check logs/proxies for id truncation if the id looks correct in code"],"exampleFix":"// before\nconst url = `/permissions/resource/${resource.slug}.json`;\n// after\nif (!isUuid(resource.id)) throw new Error('expected resource UUID');\nconst url = `/permissions/resource/${resource.id}.json`;","handlingStrategy":"validation","validationCode":"const isUuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);\nif (!isUuid(resourceId)) throw new Error('acoForeignKey must be a resource UUID');","typeGuard":"const asResourceId = (r) => isUuid(r?.id) ? r.id : null;","tryCatchPattern":"if (!isUuid(id)) id = await resolveResourceId(resource);","preventionTips":["Pass entity.id, never slug/name/legacy numeric id","Validate format before URL construction","Watch for double URL-encoding corrupting UUIDs"],"tags":["http-400","uuid","validation","permissions"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}