passbolt/passbolt_api · error · BadRequestException

Invalid request. Please provide the required data.

Error message

Invalid request. Please provide the required data.

What it means

Thrown by the account recovery response creation endpoint when the request body is null, not an array, or empty. The endpoint requires the response payload (with the encrypted response data and security token) before invoking the create service.

Solutions

1. Send a JSON body with Content-Type: application/json containing the account_recovery_private_key_responses data.
2. Verify the client actually serializes the payload (not undefined).
3. Check proxies/gateways are not dropping the request body.
4. Confirm the client version matches the current API schema for responses.

Example fix

// before
fetch('/account-recovery/responses', {method:'POST', headers:{'Content-Type':'text/plain'}, body: JSON.stringify(data)});
// after
fetch('/account-recovery/responses', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(data)});

if (!payload || typeof payload !== 'object' || Object.keys(payload).length === 0) throw new Error('response payload required');

function hasBody(v) { return v !== null && typeof v === 'object' && !Array.isArray(v) && Object.keys(v).length > 0; }

try { await api.createAccountRecoveryResponse(payload); } catch (e) { if (e.code === 400 && /provide the required data/.test(e.message)) { /* rebuild payload and resend */ } else { throw e; } }

When it happens

Trigger: POST /account-recovery/responses with no JSON body, an empty object {}, or a body sent with the wrong Content-Type so CakePHP parses no data.

Common situations: Client forgot to JSON.stringify the payload; missing Content-Type: application/json header; middleware or proxy stripping the body; older client versions posting a different schema.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• $exception->getMessage() (dynamic, from wrapped…
• Invalid request. New key or passwords are not required.
• Invalid request. No policy change.
• Please provide a valid request id.
• The authentication token id is invalid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/35fb493b1e0067e1. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Controller/AccountRecoveryResponses/AccountRecoveryResponsesCreateController.php:48

{
    /**
     * Creates an account recovery response
     * Sends an email to the requesting user and the admins on success
     *
     * @param \Passbolt\Rbacs\Service\ActionAccessControl\RoleActionAccessControlServiceInterface $accessControlService service assessing if the user's role has access to this action
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException if the data provided is not valid
     */
    public function post(RoleActionAccessControlServiceInterface $accessControlService): void
    {
        $accessControlService->controlUserRoleActionAccess(
            $this->User->getRoleEntity(),
            UserAction::getInstance()->getActionId()
        );

        $data = $this->getRequest()->getData();
        if (!isset($data) || !is_array($data) || empty($data)) {
            throw new BadRequestException(__('Invalid request. Please provide the required data.'));
        }

        $response = (new AccountRecoveryResponsesCreateService())->create($this->User->getAccessControl(), $data);

        $this->success(__('The operation was successful.'), $response);
    }
}

View on GitHub (pinned to 31c1bbc10f)