ory/kratos · error

array must not be empty

Error message

array must not be empty

What it means

parseManageSessionsIDs in the session admin API parses an explicit list of session UUIDs for manage/kill-sessions operations and rejects an empty input array, since the endpoint requires either the wildcard or at least one concrete session id. Callers that support the wildcard must use parseManageSessionsIDsOrWildcard instead.

Solutions

1. Include at least one session UUID in the request body, or use the wildcard '*' endpoint variant if you mean 'all sessions'
2. Guard on the client side: skip the API call when no sessions are selected
3. If 'everything' is intended, call the wildcard-accepting endpoint (parseManageSessionsIDsOrWildcard path) with "*"]

Example fix

// before
POST /admin/sessions/delete {"ids": []}
// after
POST /admin/sessions/delete {"ids": ["6d0e5a3d-...", "9b2f..." ]}
// or wildcard variant
POST /admin/sessions/delete {"ids": ["*"]}

if len(ids) === 0 throw new Error("at least one session id required (or use wildcard endpoint)")

try { ... } catch (e) { if (e.status === 400 && /array must not be empty/.test(e.message)) { /* fix request payload */ } }

When it happens

Trigger: Calling the admin 'disable/delete my other sessions' or session management endpoints with an empty array of session ids (e.g. ids: []).

Common situations: Client code builds a list from user selections and submits without checking that at least one was chosen; frontend sends the request unconditionally with an empty payload.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• the wildcard '*' is not accepted here
• failed to decode PEM block containing private key
• Private key is not ecdsa key
• no oidc provider was set
• no identifier found

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/35a16b7d4ae70b49. Report an issue: GitHub.

Appendix: source

Thrown at session/handler.go:1391

// parseManageSessionsIDsOrWildcard recognizes the network-wide wildcard form
// ["*"] and otherwise delegates to parseManageSessionsIDs. Use it in fields
// that accept the wildcard (currently `identities`); fields that do not
// accept wildcard should call parseManageSessionsIDs directly so the token is
// rejected.
func parseManageSessionsIDsOrWildcard(raw []string) (ids []uuid.UUID, wildcard bool, err error) {
	if len(raw) == 1 && raw[0] == ManageSessionsAllToken {
		return nil, true, nil
	}
	ids, err = parseManageSessionsIDs(raw)
	return ids, false, err
}

// parseManageSessionsIDs interprets a manage-sessions filter array as a list
// of explicit UUIDs and rejects any input containing the wildcard token.
// Callers that accept the wildcard must use parseManageSessionsIDsOrWildcard.
func parseManageSessionsIDs(raw []string) ([]uuid.UUID, error) {
	if len(raw) == 0 {
		return nil, errors.New("array must not be empty")
	}
	if len(raw) > ManageSessionsMaxIDs {
		return nil, fmt.Errorf("at most %d IDs may be provided per call", ManageSessionsMaxIDs)
	}
	ids := make([]uuid.UUID, 0, len(raw))
	for _, s := range raw {
		if s == ManageSessionsAllToken {
			return nil, errors.New("the wildcard '*' is not accepted here")
		}
		id, err := uuid.FromString(s)
		if err != nil {
			return nil, fmt.Errorf("could not parse %q as UUID: %w", s, err)
		}
		ids = append(ids, id)
	}
	return ids, nil
}

View on GitHub (pinned to b86338da04)