passbolt/passbolt_api · error · BadRequestException

Could not validate comment data.

Error message

Could not validate comment data.

What it means

The fallback error of CommentsAddService::_handleValidationErrors(): the comment entity failed validation for a reason other than the foreign_key resource rules (e.g. missing/invalid parent_id, empty content, invalid user_id). Since it isn't the 'resource does not exist' case, a 400 BadRequest is returned instead of 404.

Solutions

1. Inspect the response body errors array for the exact failing field, then fix that field in the payload.
2. Ensure content is a non-empty string and parent_id (if replying) is a valid comment UUID belonging to the same resource.
3. Send only the documented fields (parent_id, content) in the POST body.

Example fix

// before
POST {"parent_id": "<comment-of-another-resource>", "content": ""}
// after
POST {"content": "My comment text"}   // drop parent_id, or use a valid comment id of the same resource

const errors = [];
if (!data.content || typeof data.content !== 'string' || !data.content.trim()) errors.push('content is required');
if (data.parent_id && !isUuid(data.parent_id)) errors.push('parent_id must be a UUID');
if (errors.length) throw new Error(errors.join('; '));

try { await addComment(resourceId, data); }
catch (e) { if (e.response?.status === 400) showFieldErrors(e.response.data.errors ?? {}); else throw e; }

When it happens

Trigger: POSTing a comment with empty content, invalid parent comment id (reply-to not a UUID or not a comment of the same resource), missing required fields, or extra invalid fields in the payload.

Common situations: Building reply comments with the wrong parent_id (parent belongs to a different resource); sending content as null/absent; client sending legacy field names after an API change; whitespace-only content.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not delete comment.
• Could not delete favorite.
• Could not save the account recovery setting.
• Could not validate comment data.
• Could not validate settings.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/f4121914844d8242. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Comments/CommentsAddService.php:102

     * @throws \Cake\Http\Exception\BadRequestException
     * @throws \Cake\Http\Exception\NotFoundException
     * @return void
     */
    protected function _handleValidationErrors(Comment $comment): void
    {
        $errors = $comment->getErrors();
        if (!empty($errors)) {
            if (
                !empty($errors['foreign_key']) &&
                (
                    !empty($errors['foreign_key']['resource_exists']) ||
                 !empty($errors['foreign_key']['resource_is_soft_deleted']) ||
                 !empty($errors['foreign_key']['has_resource_access'])
                )
            ) {
                throw new NotFoundException(__('The resource does not exist.'));
            }
            throw new BadRequestException(__('Could not validate comment data.'));
        }
    }

    /**
     * Build and validate comment entity from user input.
     *
     * @param \App\Utility\UserAccessControl $uac The user access control
     * @param string $foreignKey The identifier of the instance the comment belongs to.
     * @param array $data The comment data
     * @return \App\Model\Entity\Comment $comment comment entity
     */
    protected function _buildAndValidateCommentEntity(UserAccessControl $uac, string $foreignKey, array $data): Comment
    {
        // Build entity and perform basic check.
        /**
         * @var \App\Model\Entity\Comment $comment
         */
        $comment = $this->Comments->newEntity(

View on GitHub (pinned to 31c1bbc10f)