passbolt/passbolt_api · error · BadRequestException

The authentication token does not exist.

Error message

The authentication token does not exist.

What it means

SsoSettingsActivateService::activate() first verifies the draft SSO activation token exists via the auth token service, using type TYPE_SSO_SET_SETTINGS. If getOrFail() raises RecordNotFoundException, the error is deliberately remapped to a BadRequestException (400) instead of 404, because 'not found' is reserved for the settings themselves in this context.

Solutions

1. Pass the correct, unconsumed token returned when the draft SSO settings were created
2. Ensure the token is fetched from the SSO draft settings creation flow, not from another token type
3. Re-create the draft SSO settings to generate a fresh token if it was consumed or purged

Example fix

// before
$service->activate($uac, $settingId, ['status' => 'active']); // token missing
// after
$service->activate($uac, $settingId, ['token' => $draftToken, 'status' => 'active']);

if (empty($data['token']) || !is_string($data['token'])) { throw new \InvalidArgumentException('A valid activation token is required'); }

try { $service->activate($uac, $id, $data); } catch (BadRequestException $e) { // token missing/consumed: regenerate draft token }

When it happens

Trigger: Calling activate() with a missing, deleted, or wrong-type token in $data['token'] (or omitting the key entirely — '' is then looked up and not found). Any token not of type sso_set_settings also misses.

Common situations: Reusing an already-consumed activation token after a prior activation attempt; copying the draft settings id instead of the token; expired/purged auth tokens; hitting activate twice from a stale browser tab.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid status.
• The authentication token does not exist or has been deleted.
• The authentication token has been expired.
• The settings status is invalid.
• The SSO setting id should be a uuid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/cec72fcff73f46cd. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsActivateService.php:84

    {
        // User must be an admin
        $uac->assertIsAdmin();

        // Trying to activate the settings
        $this->assertActiveStatus($data);

        // Status must in draft status
        $ssoSettingEntity = $this->assertAndGetSettings($id, SsoSetting::STATUS_DRAFT);

        // Token must be provided and matching the settings, user id, ip, user agent, etc.
        $authTokenService = new SsoAuthenticationTokenGetService();
        $type = SsoState::TYPE_SSO_SET_SETTINGS;

        // If token is not found remap error, not found in this context is reserved for settings
        try {
            $ssoAuthToken = $authTokenService->getOrFail($data['token'] ?? '', $type);
        } catch (RecordNotFoundException $exception) {
            throw new BadRequestException($exception->getMessage(), 400, $exception);
        }

        // Consume or be consumed
        $authTokenService->assertAndConsume($ssoAuthToken, $uac, $ssoSettingEntity->id);

        // Activate
        try {
            $ssoSettingEntity->status = SsoSetting::STATUS_ACTIVE;
            $ssoSettingEntity->modified_by = $uac->getId();
            $this->SsoSettings->save($ssoSettingEntity);
            (new SsoSettingsDeleteService())->deleteAllBut($id);
        } catch (Exception $exception) {
            throw new InternalErrorException(__('Could not update the SSO settings.'), 500, $exception);
        }

        // Notify settings have been changed
        $event = new Event(
            self::AFTER_ACTIVATE_SSO_SETTINGS_EVENT,

View on GitHub (pinned to 31c1bbc10f)