nextcloud/server · error · Sabre\DAV\Exception\BadRequest

The given request is not valid

Error message

The given request is not valid

What it means

HTTP 400 BadRequest thrown by the DAV sharing plugin's validateShareRequest() when a POST body routed into the '{http://owncloud.org/ns}share' case does not deserialize into a ShareRequest object. The plugin registers the XML element map '{oc}share' -> ShareRequest and '{oc}invite' -> Invite, so this guard mostly fires defensively when the parsed root element maps to a different class than expected — malformed share XML or an elementMap overridden by another app.

Source

Thrown at apps/dav/lib/DAV/Sharing/Plugin.php:178

					}
				}

				$node->updateShares($message->set, $message->remove);

				$response->setStatus(Http::STATUS_OK);
				// Adding this because sending a response body may cause issues,
				// and I wanted some type of indicator the response was handled.
				$response->setHeader('X-Sabre-Status', 'everything-went-well');

				// Breaking the event chain
				return false;
		}
	}

	private function validateShareRequest($shareRequest): void {
		if (!$shareRequest instanceof ShareRequest) {
			// @FIXME: Replace switch-case in httpPost with instanceof ShareRequest
			throw new BadRequest('The given request is not valid');
		}

		$elements = (count($shareRequest->set) + count($shareRequest->remove));

		if ($elements === 0) {
			throw new BadRequest(ShareRequest::ELEMENT_SHARE . ' needs at least one set or remove element');
		}

		if ($elements > 10) {
			throw new BadRequest(ShareRequest::ELEMENT_SHARE . ' is limited to 10 set or remove elements');
		}
	}

	private function preloadCollection(PropFind $propFind, ICollection $collection): void {
		if (!$collection instanceof CalendarHome || $propFind->getDepth() !== 1) {
			return;
		}

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Send a well-formed share document: root element {http://owncloud.org/ns}share containing at least one set and/or remove child
2. Verify the namespace is exactly http://owncloud.org/ns and Content-Type is application/xml or text/xml
3. If you meant the legacy invite protocol, send an {http://owncloud.org/ns}invite document instead
4. Replay a known-good request (share via web UI while watching the DAV traffic) and diff it against your client's body

Example fix

// before: wrong root element/namespace -> 400 'The given request is not valid'
POST /remote.php/dav/addressbooks/admin/contacts/
Content-Type: application/xml

<x0:share xmlns:x0='http://calendarserver.org/ns/'>...</x0:share>
// after
POST /remote.php/dav/addressbooks/admin/contacts/
Content-Type: application/xml

<x1:share xmlns:x1='http://owncloud.org/ns' xmlns:d='DAV:'>
  <x1:set><d:href>principal:principals/users/alice</d:href></x1:set>
</x1:share>

// validate before sending: root must be {http://owncloud.org/ns}share
function assertShareDocument(xmlString) {
  const doc = new DOMParser().parseFromString(xmlString, 'application/xml');
  if (doc.querySelector('parsererror')) throw new Error('malformed XML');
  const root = doc.documentElement;
  if (root.namespaceURI !== 'http://owncloud.org/ns' || root.localName !== 'share') {
    throw new Error('root element must be {http://owncloud.org/ns}share');
  }
  return doc;
}

function isShareRequestShape(parsed) {
  return parsed !== null && typeof parsed === 'object'
    && Array.isArray(parsed.set)
    && Array.isArray(parsed.remove);
}

try {
  await davPost(bookUrl, shareBody);
} catch (e) {
  if (e.status === 400) { logClientError('share body rejected', shareBody); /* fix body, do not blind-retry */ }
  else throw e;
}

When it happens

Trigger: POST with Content-Type application/xml or text/xml to a calendar/address book path where the body parses to a message object that is not a ShareRequest — typically hand-built XML with the wrong root element/namespace, or another app overriding the server's xml elementMap for {oc}share.

Common situations: Custom provisioning tools generating share XML by string concatenation; clients migrating from the legacy {oc}invite protocol; typos in the http://owncloud.org/ns namespace URI; third-party DAV apps conflicting with the sharing plugin's element map.

Related errors

• {http://owncloud.org/ns}share needs at least one set or remo
• {http://owncloud.org/ns}share is limited to 10 set or remove
• Message exceeds allowed character limit of 1000
• Invalid input values
• The {http://nextcloud.com/ns}comp-filter requires a valid na

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/0d69018ddc458eea. Report an issue: GitHub.