passbolt/passbolt_api · error · CakeException

" " is not a valid user filter.

Error message

"{0}" is not a valid user filter.

What it means

Thrown by validateFilterUsers when an entry of a users filter array has a non-integer array key. Like the search filter, the users filter must be a numerically indexed list of user IDs; string keys indicate malformed structure.

Solutions

1. Send user IDs numerically indexed: filter[has-users][0]=<uuid>&filter[has-users][1]=<uuid>
2. Server-side, reindex with array_values($values) before validating when the shape is trusted
3. Use a different filter/validator if a named parameter was intended
4. Catch CakeException and return 400 describing the expected list-of-uuids format

Example fix

// before
params['filter[has-users][id]'] = userId;
// after
params['filter[has-users][0]'] = userId;

$isShaped = array_is_list($values); if (!$isShaped) { $values = array_values($values); }

$isValid = is_array($values) && array_is_list($values);

try { validateFilterUsers($values, $filterName); } catch (\Cake\Core\Exception\CakeException $e) { throw new BadRequestException($e->getMessage()); }

When it happens

Trigger: validateFilterUsers receives an array with associative keys, e.g. ['users' => 'uuid'] or filter[has-users][id]=..., instead of filter[has-users][0]=<uuid>.

Common situations: Clients nesting the user id under a named key; query parsers preserving string keys; hand-built arrays in tests or internal callers.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• " " is not a valid search filter.
• " " is not a valid value for filter .
• " " is not a valid search filter. It is not a UTF8 string.
• " " is not a valid search filter. It should be between 1…
• Could not validate the password policies settings.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d8b75404737b8f71. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Component/QueryStringComponent.php:483

    }

    /**
     * Validate Users Filters
     * Input must be a non-assoc array with utf8 char values between 3 and 64 char in length
     * Examples:
     * - Bueno: [0 => '98c2bef5-cd5f-59e7-a1a7-0107c9a7cf08']
     * - No Bueno: ['this' => 'no']
     *
     * @param array $values array of user id to check
     * @param string $filterName for error message display
     * @throw CakeException if the filter is not valid
     * @return bool true if the filter is valid
     */
    public static function validateFilterUsers(array $values, string $filterName): bool
    {
        foreach ($values as $i => $userId) {
            if (!is_int($i)) {
                throw new CakeException(__('"{0}" is not a valid user filter.', $i, $filterName));
            }
            if (!is_scalar($userId) || empty($userId)) {
                throw new CakeException(__('"{0}" is not a valid user filter.', $i));
            }
            if (!Validation::uuid($userId)) {
                throw new CakeException(__('"{0}" is not a valid user id for filter {1}.', $userId, $filterName));
            }
        }

        return true;
    }

    /**
     * Validate a filter that is an array of group id
     * Examples:
     * - Bueno: [0 => '98c2bef5-cd5f-59e7-a1a7-0107c9a7cf08']
     * - No Bueno: ['this' => 'no']
     *

View on GitHub (pinned to 31c1bbc10f)