passbolt/passbolt_api · warning · Cake\Http\Exception\BadRequestException

Some user data should be provided.

Error message

Some user data should be provided.

What it means

BadRequestException (HTTP 400) from assertRequestData: the edit payload is empty or has fewer than two top-level entries, so there is nothing meaningful to update (at minimum `id` plus one field). The controller rejects no-op edits early.

Solutions

1. Send at least `id` plus one actual field to update, or skip the request when there is no change.
2. Check client diffing/serialization logic so changed fields are not dropped.
3. Validate the payload is non-empty before calling the API.

Example fix

// before
const changes = diff(currentUser, newUser); // may be {}
if (Object.keys(changes).length) await api.editUser(id, { id, ...changes });
// after
if (!Object.keys(changes).length) return; // skip update entirely
await api.editUser(id, { id, ...changes });

function isMeaningfulEdit(data) { return data && Object.keys(data).length >= 2; } // id + at least one field
if (!isMeaningfulEdit(payload)) throw new Error('No user changes to save');

try { await api.editUser(id, data); } catch (e) { if (e.code === 400 && /Some user data should be provided/.test(e.message)) { return; /* nothing to update */ } throw e; }

When it happens

Trigger: PUT /users/{id}.json with an empty body, or a body containing only `id` (count < 2).

Common situations: Client builds a diff object that ends up empty because nothing changed; serialization drops all fields; form submitted without any modifications; a bug stripping the payload before send.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Information about the key is required.
• Invalid query string. The contain parameter should be an…
• Invalid query string. The filter parameter should be an…
• Multiple has-access filters are not supported.
• The comment id is not valid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/4faf95e30365bb72. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Users/UsersEditController.php:170

        }
        if ($this->User->role() !== Role::ADMIN && (isset($data['role']) || isset($data['role_id']))) {
            throw new ForbiddenException(__('You are not authorized to edit the role.'));
        }
    }

    /**
     * Validate the data coming from the request
     *
     * @param array $data user data
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException if gpgkey is sent (v2 only)
     * @throws \Cake\Http\Exception\BadRequestException if groups data is sent (v2 only)
     * @throws \Cake\Http\Exception\BadRequestException if data is not provided or invalid
     */
    protected function assertRequestData(array $data): void
    {
        if (empty($data) || count($data) < 2) {
            throw new BadRequestException(__('Some user data should be provided.'));
        }
        if (isset($data['gpgkey'])) {
            throw new BadRequestException(__('Updating the OpenPGP key is not allowed.'));
        }
        if (isset($data['groups_user'])) {
            throw new BadRequestException(__('Updating the groups is not allowed.'));
        }
    }

    /**
     * Sends an email to all admins when a user has been disabled
     * Sends an email to the user disabled if that user is an admin
     *
     * @param \App\Model\Entity\User $user User being edited
     * @return void
     */
    protected function sendEmailOnUserDisable(User $user): void
    {

View on GitHub (pinned to 31c1bbc10f)