passbolt/passbolt_api · error · CakeException

" " is not a valid user id for filter .

Error message

"{0}" is not a valid user id for filter {1}.

What it means

Thrown by QueryStringComponent::validateFilterUsers when a value in a user-id filter array (e.g. the 'has-users' filter) passes the scalar/empty checks but fails Cake\Validation::uuid(), meaning it is not a well-formed UUID. The API expects every user id in list-type query filters to be a UUID string. It is raised as a CakeException during query-string validation before any controller action logic runs.

Solutions

1. Inspect the failing value shown in the exception message and replace it with the user's actual UUID (look it up via GET /users).
2. Validate each filter value with \Cake\Validation\Validation::uuid() client-side before sending the request.
3. Ensure the filter array is numerically indexed (filter[has-users][]=... produces integer keys; avoid custom keys).
4. If ids come from another system, confirm they were not re-encoded (e.g. base64 or with dashes stripped) between storage and the request.

Example fix

// before
$filter = ['has-users' => ['ada@example.com']];
// after
$filter = ['has-users' => ['98c2bef5-cd5f-59e7-a1a7-0107c9a7cf08']];

use Cake\Validation\Validation;
if (!is_array($values) || array_values($values) !== $values) {
    throw new \InvalidArgumentException('Filter must be a list.');
}
foreach ($values as $v) {
    if (!is_string($v) || !Validation::uuid($v)) {
        throw new \InvalidArgumentException("Not a valid user UUID: " . var_export($v, true));
    }
}

function isUserFilterList(mixed $values): bool {
    return is_array($values)
        && array_values($values) === $values
        && array_all($values, fn($v) => is_string($v) && \Cake\Validation\Validation::uuid($v));
}

try {
    $result = $resourcesIndex->withFilter('has-users', $userIds);
} catch (\Cake\Core\Exception\CakeException $e) {
    if (str_contains($e->getMessage(), 'is not a valid user id')) {
        $logger->warning('Bad user filter id', ['msg' => $e->getMessage()]);
        return $this->response->withStatus(400);
    }
    throw $e;
}

When it happens

Trigger: Calling an endpoint that supports a user filter (e.g. GET /resources?filter[has-users][]=<value>) with a value that is a non-empty scalar but not a UUID, such as 'abc', an email address, or a truncated id. Keys must be integers (non-assoc array); keys are checked before this UUID check, so this specific error fires only for a bad string value under a valid integer key.

Common situations: Client code passes a user's email or label instead of the id; a stored id was truncated or reformatted by middleware/DB; an older API version accepted non-UUID identifiers and scripts still send them; copy-paste errors when hardcoding ids in integration tests.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• " " is not a valid group id for filter .
• " " is not a valid parent id for filter .
• " " is not a valid group filter.
• " " is not a valid parent filter.
• " " is not a valid resource id for filter .

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/787a4fa930f04e49. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Component/QueryStringComponent.php:489

     * - Bueno: [0 => '98c2bef5-cd5f-59e7-a1a7-0107c9a7cf08']
     * - No Bueno: ['this' => 'no']
     *
     * @param array $values array of user id to check
     * @param string $filterName for error message display
     * @throw CakeException if the filter is not valid
     * @return bool true if the filter is valid
     */
    public static function validateFilterUsers(array $values, string $filterName): bool
    {
        foreach ($values as $i => $userId) {
            if (!is_int($i)) {
                throw new CakeException(__('"{0}" is not a valid user filter.', $i, $filterName));
            }
            if (!is_scalar($userId) || empty($userId)) {
                throw new CakeException(__('"{0}" is not a valid user filter.', $i));
            }
            if (!Validation::uuid($userId)) {
                throw new CakeException(__('"{0}" is not a valid user id for filter {1}.', $userId, $filterName));
            }
        }

        return true;
    }

    /**
     * Validate a filter that is an array of group id
     * Examples:
     * - Bueno: [0 => '98c2bef5-cd5f-59e7-a1a7-0107c9a7cf08']
     * - No Bueno: ['this' => 'no']
     *
     * @param array $values array of group id to check
     * @param string $filterName for error message display
     * @throw CakeException if the filter is not valid
     * @return bool true if validate
     */
    public static function validateFilterGroups(array $values, string $filterName): bool

View on GitHub (pinned to 31c1bbc10f)