langfuse/langfuse · error

Invalid request parameters

Error message

Invalid request parameters

What it means

The query/path parameters for DELETE /api/public/projects/{projectId}/apiKeys/{apiKeyId} failed Zod-style validation in validateQueryParams. Both projectId and apiKeyId must be present and valid; otherwise a 400 is returned before any database lookup.

Source

Thrown at web/src/pages/api/public/projects/[projectId]/apiKeys/[apiKeyId].ts:70

      })
    ) {
      return res.status(403).json({
        error: "This feature is not available on your current plan.",
      });
    }

    const rateLimitCheck =
      await RateLimitService.getInstance().rateLimitRequest(
        authCheck.scope,
        "public-api",
      );
    if (rateLimitCheck?.isRateLimited()) {
      return rateLimitCheck.sendRestResponseIfLimited(res);
    }

    const params = validateQueryParams(req.query);
    if (!params) {
      return res.status(400).json({ message: "Invalid request parameters" });
    }

    const { projectId, apiKeyId } = params;

    // Check if project exists and belongs to the organization
    const project = await prisma.project.findFirst({
      where: {
        id: projectId,
        orgId: authCheck.scope.orgId,
      },
    });

    if (!project) {
      return res
        .status(404)
        .json({ message: "Project not found or you don't have access to it" });
    }

View on GitHub (pinned to 59d92c7cf3)

Solutions

1. Ensure the request path is exactly /api/public/projects/{projectId}/apiKeys/{apiKeyId} with both ids as non-empty strings.
2. Log the final URL before sending to catch undefined/empty interpolations.
3. Regenerate the API client from the current Fern/OpenAPI spec so required path params are enforced at compile time.

Example fix

// before
fetch(`${baseUrl}/api/public/projects/${projectId}/apiKeys/${undefined}`)
// after
fetch(`${baseUrl}/api/public/projects/${projectId}/apiKeys/${encodeURIComponent(apiKeyId)}`)

if (typeof projectId !== 'string' || !projectId) throw new Error('projectId required');
if (typeof apiKeyId !== 'string' || !apiKeyId) throw new Error('apiKeyId required');
const url = `${baseUrl}/api/public/projects/${encodeURIComponent(projectId)}/apiKeys/${encodeURIComponent(apiKeyId)}`;

function isValidId(id: unknown): id is string {
  return typeof id === 'string' && id.trim().length > 0;
}

When it happens

Trigger: Omitting apiKeyId from the path, passing empty strings (e.g. /apiKeys/ or /apiKeys/%20), or non-string values caused by duplicated query params or malformed URL construction.

Common situations: Template-literal URL building with undefined variables, URL-encoding issues, or copy-pasting the collection route without appending the key id.

Related errors

• Invalid request parameters
• Invalid request body
• Invalid request body
• Invalid request body
• Invalid request data

AI-assisted analysis of langfuse/langfuse@59d92c7cf3 (2026-08-27). Data as JSON: /api/errors/4986959e9668ce7d. Report an issue: GitHub.