passbolt/passbolt_api · error · CakeException

" " is not a valid contain value.

Error message

"{0}" is not a valid contain value.

What it means

validateContain checks each value of the 'contain' query-string parameter; every contain value must be a boolean indicating whether to include the associated data. It throws when a contain value is not a boolean, rejecting strings or numbers that the API will not coerce.

Solutions

1. Use contain[<association>]=true or contain[<association>]=false exactly.
2. Check the controller's allowed contain names to pick a valid association key.
3. Quote the whole URL in curl to avoid shell corruption of brackets and values.
4. Update legacy clients that send 1/0 to send true/false.

Example fix

// before
GET /resources?contain[permissions]=1
// after
GET /resources?contain[permissions]=true

if (typeof containValue !== 'boolean') {
  throw new Error(`contain[${key}] must be true or false`);
}

function isBoolean(v: unknown): v is boolean {
  return typeof v === 'boolean';
}

When it happens

Trigger: GET /resources?contain[permissions]=1 or contain[creator]=yes — PHP accepts '1'/'0' in some contexts but the validated value must resolve to a boolean (true/false).

Common situations: Clients using 1/0 or yes/no instead of true/false; curl users forgetting to quote values so shells mangle them; older API clients using legacy contain conventions.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalid contain.
• " " is not a valid datetime for filter .
• " " is not a valid group filter.
• " " is not a valid group id for filter .
• " " is not a valid order.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/07e98111bf2ba631. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Component/QueryStringComponent.php:700

            }
        }

        return true;
    }

    /**
     * Validate Contain
     *
     * @param array|null $contain conditions
     * @return bool true if validate
     * @throws \Cake\Core\Exception\CakeException if the contain value is not 0 or 1
     */
    public static function validateContain(?array $contain = null): bool
    {
        if (isset($contain)) {
            foreach ($contain as $value) {
                if (!is_bool($value)) {
                    throw new CakeException(__('"{0}" is not a valid contain value.', $value));
                }
            }
        }

        return true;
    }

    /**
     * Normalize string to boolean if it looks like one
     * 'TRUE', 'True', 'true', '1' becomes true
     * 'FALSE', 'False', 'false', '0' becomes false
     *
     * @param mixed $str the string to normalize
     * @return string|bool if original string is not bool
     */
    public static function normalizeBoolean(mixed $str)
    {
        if (is_bool($str)) {

View on GitHub (pinned to 31c1bbc10f)