nextcloud/server · error · Sabre\DAV\Exception\BadRequest

Invalid input values

Error message

Invalid input values

What it means

The comments manager rejected the creation call: CommentsManager::create() throws InvalidArgumentException for an unknown or empty objectType/objectId (or invalid actor data), and setMessage()/setVerb() throw it for malformed content. The DAV plugin wraps any of these into BadRequest('Invalid input values'), HTTP 400, with the original exception chained as the previous exception.

Source

Thrown at apps/dav/lib/Comments/CommentsPlugin.php:230

		$actorId = null;
		if ($actorType === 'users') {
			$user = $this->userSession->getUser();
			if (!is_null($user)) {
				$actorId = $user->getUID();
			}
		}
		if (is_null($actorId)) {
			throw new BadRequest('Invalid actor "' . $actorType . '"');
		}

		try {
			$comment = $this->commentsManager->create($actorType, $actorId, $objectType, $objectId);
			$comment->setMessage($data['message']);
			$comment->setVerb($data['verb']);
			$this->commentsManager->save($comment);
			return $comment;
		} catch (\InvalidArgumentException $e) {
			throw new BadRequest('Invalid input values', 0, $e);
		} catch (MessageTooLongException $e) {
			$msg = 'Message exceeds allowed character limit of ';
			throw new BadRequest($msg . IComment::MAX_MESSAGE_LENGTH, 0, $e);
		}
	}
}

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Verify objectType is a registered entity type (default: 'files') and objectId is a non-empty id of an existing object.
2. Include a valid verb ('comment' for file comments) and a clean UTF-8 message in the payload.
3. Reproduce server-side with ICommentManager::create() on occ, which surfaces the raw InvalidArgumentException message and pinpoints the offending field.

Example fix

// before: HTTP 400 Invalid input values
$payload = ['actorType' => 'users', 'objectType' => 'file', 'objectId' => '', 'verb' => '', 'message' => $text];

// after: registered type, non-empty id, valid verb
$payload = ['actorType' => 'users', 'objectType' => 'files', 'objectId' => (string)$fileId, 'verb' => 'comment', 'message' => $text];

$knownTypes = ['files']; // extend with types registered by apps via CommentsEntityEvent
if (!in_array($payload['objectType'] ?? '', $knownTypes, true)
    || trim((string)($payload['objectId'] ?? '')) === ''
    || !isset($payload['verb'], $payload['message'])) {
    throw new InvalidArgumentException('Comment payload incomplete or objectType unknown');
}

try {
    $client->request('POST', $commentsUrl, $body);
} catch (ClientHttpException $e) {
    if ($e->getResponse()->getStatusCode() === 400
        && str_contains($e->getResponse()->getBody()->getContents(), 'Invalid input values')) {
        // one of objectType/objectId/verb/message was rejected — log payload fields
    }
}

When it happens

Trigger: POST a comment whose objectType is not a registered comments entity (only 'files' unless an app registers more via CommentsEntityEvent), whose objectId is empty or 0, whose verb is missing or invalid, or whose message contains content Comment::setMessage() refuses (e.g. invalid UTF-8 or control characters).

Common situations: Typos in objectType ('file' instead of 'files'); forgetting the verb field in the JSON body; clients sending byte strings that decode as JSON but fail UTF-8 validation; objectId sent as 0 after a failed file lookup.

Related errors

• Message exceeds allowed character limit of 1000
• Invalid actor "$actorType"
• Message exceeds allowed character limit of 1000
• The given request is not valid
• URI too long. Address book not created

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/4ebad5be24e55891. Report an issue: GitHub.