nextcloud/server · error · Sabre\DAV\Exception\BadRequest

{http://owncloud.org/ns}share is limited to 10 set or remove

Error message

{http://owncloud.org/ns}share is limited to 10 set or remove elements

What it means

HTTP 400 BadRequest from validateShareRequest() when a single share POST carries more than 10 set plus remove elements combined. The hard cap of 10 share operations per request protects the share backend from oversized batch updates; it is independent of the per-user rate limit (error 280).

Source

Thrown at apps/dav/lib/DAV/Sharing/Plugin.php:188

				// Breaking the event chain
				return false;
		}
	}

	private function validateShareRequest($shareRequest): void {
		if (!$shareRequest instanceof ShareRequest) {
			// @FIXME: Replace switch-case in httpPost with instanceof ShareRequest
			throw new BadRequest('The given request is not valid');
		}

		$elements = (count($shareRequest->set) + count($shareRequest->remove));

		if ($elements === 0) {
			throw new BadRequest(ShareRequest::ELEMENT_SHARE . ' needs at least one set or remove element');
		}

		if ($elements > 10) {
			throw new BadRequest(ShareRequest::ELEMENT_SHARE . ' is limited to 10 set or remove elements');
		}
	}

	private function preloadCollection(PropFind $propFind, ICollection $collection): void {
		if (!$collection instanceof CalendarHome || $propFind->getDepth() !== 1) {
			return;
		}

		$backend = $collection->getCalDAVBackend();
		if (!$backend instanceof CalDavBackend) {
			return;
		}

		$calendars = $collection->getChildren();
		$calendars = array_filter($calendars, static fn (INode $node) => $node instanceof IShareable);
		/** @var int[] $resourceIds */
		$resourceIds = array_map(
			static fn (IShareable $node) => $node->getResourceId(), $calendars);

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Split the sharee list into multiple POSTs of at most 10 set/remove elements each
2. Cap batch size in your sharing client/library at 10
3. For very large rollouts, provision shares via occ commands or the OCS Share API instead of CalDAV share POSTs

Example fix

// before: 25 sharees in one body -> 400 'limited to 10 set or remove elements'
const xml = shareXml(allSharees);
await davPost(shareUrl, xml);
// after: chunk into requests of <= 10 elements
for (const batch of chunk(allSharees, 10)) {
  await davPost(shareUrl, shareXml(batch));
}

const MAX_ELEMENTS_PER_SHARE_POST = 10;
function* shareBatches(operations) {
  for (let i = 0; i < operations.length; i += MAX_ELEMENTS_PER_SHARE_POST) {
    yield operations.slice(i, i + MAX_ELEMENTS_PER_SHARE_POST);
  }
}

When it happens

Trigger: Sharing a calendar or address book with more than 10 users/groups in one <oc:share> body; bulk-migration scripts concatenating all sharees into a single share document.

Common situations: Company-wide calendar rollouts scripted in one request; import tools replaying a saved share list; clients without pagination of share operations.

Related errors

• The given request is not valid
• {http://owncloud.org/ns}share needs at least one set or remo
• The {http://nextcloud.com/ns}comp-filter requires a valid na
• The {http://nextcloud.com/ns}limit has illegal value
• The {http://nextcloud.com/ns}offset has illegal value

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/a0d7a8a1de94adeb. Report an issue: GitHub.