passbolt/passbolt_api · error · BadRequestException

The authentication token should be a valid UUID.

Error message

The authentication token should be a valid UUID.

What it means

UUID guard in AbstractCompleteService::getAndAssertToken() (used by buildAuthenticationTokenEntity and buildUserEntity during setup/complete flows): the authentication token supplied in the request data must be a valid UUID. Fires when the token parameter is absent or malformed (the legacy 'authenticationtoken' data key is deprecated since v3.6), rejecting the completion request with HTTP 400 before the token is fetched or its expiry/active state is checked.

Solutions

1. Send the token exactly as issued (a UUID)
2. Restart the setup/recovery flow to get a fresh token

When it happens

Trigger: Thrown at src/Service/Setup/AbstractCompleteService.php:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/f168e79c3878fe3e. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Setup/AbstractCompleteService.php:99

     * @throws \Cake\Http\Exception\BadRequestException if no authentication token was provided
     * @throws \Cake\Http\Exception\BadRequestException if the authentication token is not a uuid
     * @throws \Cake\Http\Exception\BadRequestException if the authentication token is expired or invalid
     * @return \App\Model\Entity\AuthenticationToken
     */
    protected function getAndAssertToken(string $userId, string $tokenType): AuthenticationToken
    {
        $data = $this->request->getData();

        // @deprecated since v3.6
        if (isset($data['authenticationtoken'])) {
            $data['authentication_token'] = $data['authenticationtoken'];
        }
        if (!isset($data['authentication_token']) || !isset($data['authentication_token']['token'])) {
            throw new BadRequestException(__('An authentication token should be provided.'));
        }
        $token = $data['authentication_token']['token'];
        if (!Validation::uuid($token)) {
            throw new BadRequestException(__('The authentication token should be a valid UUID.'));
        }
        try {
            return (new AuthenticationTokenGetService())->getActiveNotExpiredOrFail($token, $userId, $tokenType);
        } catch (NotFoundException $exception) {
            throw new BadRequestException(__('The authentication token is not valid.'));
        }
    }

    /**
     * Atomically consume a Setup/Recover token; loser of a concurrent race
     * throws the same `CustomValidationException` shape as `getActiveOrFail`.
     *
     * @param \App\Model\Entity\AuthenticationToken $token token entity previously fetched via `getAndAssertToken`
     * @return void
     * @throws \App\Error\Exception\CustomValidationException if the token was already consumed
     */
    protected function consumeTokenOrFail(AuthenticationToken $token): void
    {

View on GitHub (pinned to 31c1bbc10f)