passbolt/passbolt_api · error · BadRequestException

The comment id is not valid.

Error message

The comment id is not valid.

What it means

CommentsDeleteService::delete() sanity-checks that the comment id is a valid UUID before attempting retrieval. A non-UUID id cannot exist in the comments table, so the request is rejected immediately with 400 before any DB access.

Solutions

1. Log/inspect the id actually sent in the DELETE request and replace it with the comment's UUID.
2. Fix the client code that selects which variable is used for the id path segment.
3. Validate the id with a UUID regex before issuing DELETE.

Example fix

// before
deleteComment(currentUser.id)
// after
deleteComment(comment.id) // must be the comment's UUID, not the user's

if (!isUuid(commentId)) throw new Error(`comment id must be a UUID, got: ${commentId}`);

function isUuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v); }

try { await deleteComment(commentId); }
catch (e) { if (e.response?.status === 400 && /comment id/.test(e.response?.data?.message ?? '')) console.error('malformed id:', commentId); else throw e; }

When it happens

Trigger: DELETE /comments/{id} where id is not a 36-char UUID — e.g. an empty path segment, a slug, a truncated copy-paste, or passing the userId in place of the comment id.

Common situations: Client building the DELETE URL with the wrong variable (swapping comment id and user id); empty id from an unset variable in JS (undefined interpolated into the URL); integer ids from legacy data.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The group id is not valid.
• The group identifier should be a valid UUID.
• The identifier should be a valid UUID.
• The resource identifier should be a valid UUID.
• The resource identifier should be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/f30a69a7ee6f5907. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Comments/CommentsDeleteService.php:56

    public function __construct()
    {
        $this->Comments = TableRegistry::getTableLocator()->get('Comments');
    }

    /**
     * Delete a comment.
     *
     * @param string $id The identifier of comment to delete.
     * @param string|null $userId The user identifier who comments
     * @throws \Cake\Http\Exception\BadRequestException
     * @throws \Cake\Http\Exception\NotFoundException
     * @return void
     */
    public function delete(string $id, ?string $userId = null): void
    {
        // Check request sanity
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The comment id is not valid.'));
        }
        if (is_null($userId) || empty($userId)) {
            throw new BadRequestException(__('The comment userId is not valid.'));
        }

        // Retrieve the comment.
        try {
            /**
             * @var \App\Model\Entity\Comment $comment
             */
            $comment = $this->Comments->get($id);
        } catch (RecordNotFoundException $e) {
            throw new NotFoundException(__('The comment does not exist.'));
        }

        // Delete the comment.
        $this->Comments->delete($comment, ['Comments.user_id' => $userId]);
        $this->_handleDeleteErrors($comment);

View on GitHub (pinned to 31c1bbc10f)