ory/kratos · error

the wildcard '*' is not accepted here

Error message

the wildcard '*' is not accepted here

What it means

parseManageSessionsIDs rejects the wildcard token '*' in the explicit-ID variant of the manage-sessions filter. The wildcard is only meaningful in parseManageSessionsIDsOrWildcard; passing it here is treated as a misuse because the caller explicitly wants concrete UUIDs.

Solutions

1. Send explicit session UUIDs instead of '*' to this endpoint
2. Use the wildcard-enabled endpoint (the one using parseManageSessionsIDsOrWildcard) when you intend to match all sessions
3. Fix the client to distinguish 'select all' (wildcard endpoint) from 'select these' (UUID list)

Example fix

// before
POST /admin/sessions/... {"ids": ["*"]}
// after
POST /admin/sessions/... {"ids": ["6d0e5a3d-1c2e-4f5a-...","9b2f..."]}
// or use the wildcard endpoint for all sessions

if (ids.includes("*")) { switch to wildcard-accepting endpoint } 

When it happens

Trigger: Sending "ids": ["*"] to an admin session endpoint that only accepts explicit session UUIDs.

Common situations: Frontend reuses the same 'select all' code path for both wildcard and explicit endpoints; copy-pasting a curl example from the wildcard API into the explicit-ID API.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• array must not be empty
• failed to decode PEM block containing private key
• Private key is not ecdsa key
• no oidc provider was set
• no identifier found

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/cd0896d2b91d8b7a. Report an issue: GitHub.

Appendix: source

Thrown at session/handler.go:1399

	}
	ids, err = parseManageSessionsIDs(raw)
	return ids, false, err
}

// parseManageSessionsIDs interprets a manage-sessions filter array as a list
// of explicit UUIDs and rejects any input containing the wildcard token.
// Callers that accept the wildcard must use parseManageSessionsIDsOrWildcard.
func parseManageSessionsIDs(raw []string) ([]uuid.UUID, error) {
	if len(raw) == 0 {
		return nil, errors.New("array must not be empty")
	}
	if len(raw) > ManageSessionsMaxIDs {
		return nil, fmt.Errorf("at most %d IDs may be provided per call", ManageSessionsMaxIDs)
	}
	ids := make([]uuid.UUID, 0, len(raw))
	for _, s := range raw {
		if s == ManageSessionsAllToken {
			return nil, errors.New("the wildcard '*' is not accepted here")
		}
		id, err := uuid.FromString(s)
		if err != nil {
			return nil, fmt.Errorf("could not parse %q as UUID: %w", s, err)
		}
		ids = append(ids, id)
	}
	return ids, nil
}

// wildcardBatch runs a single chunked bulk-session operation and packages the
// row count plus a `more` flag for the response. `more` is true when the call
// reached the per-call batch limit, signaling that the caller should re-issue
// the request to drain the rest.
//
// When the row count is an exact multiple of the batch size, `more` is set
// even though no rows are left; the caller will issue one extra request that
// returns `{processed: 0, more: false}`. This is intentional — distinguishing

View on GitHub (pinned to b86338da04)