ory/kratos · error

identity schema rejected: invalid regex in…

Error message

identity schema rejected: invalid regex in patternProperties key %q: %w

What it means

When walking an identity schema, preValidateSchema treats every key of a "patternProperties" object as a regular expression and pre-compiles it with Go's regexp. If a key does not compile as RE2, walk returns this error naming the offending key, preventing a later panic inside the upstream compiler.

Solutions

1. Fix the named patternProperties key (shown as %q in the error) so it is a valid Go RE2 regular expression.
2. Remove RE2-unsupported constructs (lookarounds, backreferences) from the key; use plain character classes or explicit alternation instead.
3. Escape literal metacharacters in keys that are meant to match literally.
4. Pre-compile all patternProperties keys with regexp.Compile in a test to catch invalid keys before submitting the schema.

Example fix

// before
"patternProperties": {
  "^([0-9]+\1)$": { "type": "string" }   // backreference, invalid in RE2
}
// after
"patternProperties": {
  "^([0-9]+)$": { "type": "string" }

for key := range schemaObj["patternProperties"].(map[string]any) {
    if _, err := regexp.Compile(key); err != nil {
        return fmt.Errorf("patternProperties key %q invalid: %w", key, err)
    }
}

if strings.Contains(err.Error(), "invalid regex in patternProperties key") {
    // extract key from message and fix that specific pattern
}

When it happens

Trigger: An identity schema contains "patternProperties" with a key that is not a valid Go RE2 regex — e.g. {"(?<foo>bar)": {...}}, {"[a-": {...}} (unclosed class), or a key with an unescaped literal '%' or stray metacharacter. Raised during pre-validation of the schema.

Common situations: Schemas authored for PCRE/ECMAScript regex dialects with RE2-unsupported features; hand-written patternProperties keys with typos; generated schemas where keys were interpolated from user data containing regex metacharacters.

Related errors

• identity schema rejected: invalid regex in pattern
• invalid $ref URL
• identity schema rejected: self-referential $ref cycle
• $ref scheme is not permitted in identity schemas

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/6bf0108fe55601aa. Report an issue: GitHub.

Appendix: source

Thrown at schema/prevalidate.go:95

			case strings.HasPrefix(ref, "#/"):
				p.refs[path] = strings.TrimPrefix(ref, "#")
			}
		}

		// Pre-compile `pattern` regexes so an invalid one returns a
		// kratos-side error instead of panicking deep in
		// regexp.MustCompile during the upstream compile.
		if pat, ok := v["pattern"].(string); ok {
			if _, err := regexp.Compile(pat); err != nil {
				return fmt.Errorf("identity schema rejected: invalid regex in pattern: %w", err)
			}
		}

		// patternProperties keys are themselves regexes.
		if patternProps, ok := v["patternProperties"].(map[string]any); ok {
			for raw := range patternProps {
				if _, err := regexp.Compile(raw); err != nil {
					return fmt.Errorf("identity schema rejected: invalid regex in patternProperties key %q: %w", raw, err)
				}
			}
		}

		for k, sub := range v {
			if err := p.walk(sub, path+"/"+escapeJSONPointer(k)); err != nil {
				return err
			}
		}

	case []any:
		for i, sub := range v {
			if err := p.walk(sub, path+"/"+strconv.Itoa(i)); err != nil {
				return err
			}
		}
	}

View on GitHub (pinned to b86338da04)