flarum/framework · error · BadRequestException

Invalid sort fields [<comma-separated invalid fields>]

Error message

Invalid sort fields [<comma-separated invalid fields>]

What it means

Thrown in RequestUtil::extractSort after parsing the sort string into field=>direction pairs: any requested field not present in the endpoint's $available allow-list is rejected. This prevents arbitrary sort columns (which would leak schema details or break queries); the message lists the offending comma-separated field names and the API returns 400.

Solutions

1. Only request sort fields the endpoint documents as sortable
2. Remove unsupported fields from the sort parameter
3. If you need another sortable column, register a Sort for that endpoint server-side

When it happens

Trigger: Thrown at framework/core/src/Http/RequestUtil.php:142 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/2d14e6adf1db33a9. Report an issue: GitHub.

Appendix: source

Thrown at framework/core/src/Http/RequestUtil.php:142

        }

        $sort = [];

        foreach (explode(',', $input) as $field) {
            if (str_starts_with($field, '-')) {
                $field = substr($field, 1);
                $order = 'desc';
            } else {
                $order = 'asc';
            }

            $sort[$field] = $order;
        }

        $invalid = array_diff(array_keys($sort), $available);

        if (count($invalid)) {
            throw new BadRequestException(
                'Invalid sort fields ['.implode(',', $invalid).']',
            );
        }

        return $sort;
    }

    public static function extractLimit(Request $request, ?int $defaultLimit = null, ?int $max = null): ?int
    {
        $limit = $request->getQueryParams()['page']['limit'] ?? '';

        if (! filled($limit)) {
            $limit = $defaultLimit;
        }

        // Only short-circuit when there is genuinely no limit (no page[limit] and no
        // default). A loose `! $limit` check here also caught the string "0", returning
        // null which then broke OffsetPagination's non-nullable int $limit. An explicit

View on GitHub (pinned to 4b939f6853)