passbolt/passbolt_api · error · NotFoundException

The authentication token could not be found.

Error message

The authentication token could not be found.

What it means

Existence check in AuthenticationTokenGetService::getActiveOrFail() (also reached via getNotCompletedOrFail and getActiveNotExpiredOrFail): the token is first validated as a UUID, then looked up for the given user and token type. This error fires when no authentication token entity matches — the token is wrong, was deleted, or belongs to another user — aborting flows such as setup/registration/recovery with a not-found failure; the client must request a new token.

Solutions

1. Confirm the token, userId, and type passed match the record in authentication_tokens.
2. Resend the relevant email to generate a fresh token.
3. Check you are passing the correct AuthenticationToken type constant.
4. Verify the DB (or replica) actually contains the token row.

try {
    $token = $service->getActiveOrFail($token, $userId, $type);
} catch (\Cake\Http\Exception\NotFoundException $e) {
    // token/user/type combination not found — prompt resend
}

When it happens

Trigger: Querying with a UUID that does not exist for the given user_id and type (wrong type constant, wrong user, token deleted).

Common situations: Opening a link for a different user than the token was issued to; token already consumed then purged; copy/pasting token of another flow (register vs recover); test data wiped.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Record not found
• The authentication token is not valid.
• The authentication token is not valid.
• The metadata private key does not exist or has been deleted.
• The SCIM plugin is disabled.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/dd5fee149ec29e41. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/AuthenticationTokens/AuthenticationTokenGetService.php:105

     *
     * @param string $token authentication token
     * @param string $userId user ID
     * @param string $type token type
     * @return \App\Model\Entity\AuthenticationToken
     * @throws \Cake\Http\Exception\NotFoundException if token is not found
     * @throws \App\Error\Exception\CustomValidationException if the token is inactive
     * @throws \Cake\Http\Exception\BadRequestException if token id is not a valid uuid
     */
    public function getActiveOrFail(string $token, string $userId, string $type): AuthenticationToken
    {
        if (!Validation::uuid($token)) {
            throw new BadRequestException(__('The token should be a valid UUID.'));
        }

        $tokenEntity = $this->get($token, $userId, $type);

        if (!$tokenEntity) {
            throw new NotFoundException(__('The authentication token could not be found.'));
        }

        if ($tokenEntity->isNotActive()) {
            $error = [
                'token' => [
                    'isActive' => __('The token is already consumed.'),
                ],
            ];
            throw new CustomValidationException(__('The authentication token is not valid.'), $error);
        }

        return $tokenEntity;
    }

    /**
     * Get an authentication token given it's token, user identifier and type
     *
     * @param string $token authentication token

View on GitHub (pinned to 31c1bbc10f)