passbolt/passbolt_api · error · BadRequestException

The identifier should be a valid UUID.

Error message

The identifier should be a valid UUID.

What it means

BadRequestException raised by DirectoryIgnoreTable::createOrFail() when the $foreignKey argument is not a valid UUID. DirectoryIgnore records blacklist users/groups/entries from sync, keyed by foreign model and a UUID identifier, so a malformed identifier is rejected before any lookup.

Solutions

1. Pass the passbolt user/group UUID (from the users/groups tables), not the LDAP DN or email
2. Validate the identifier with Validation::uuid($foreignKey) before calling createOrFail
3. If you only have an email/DN, resolve it to the passbolt entity UUID first (UsersTable/GroupsTable lookup)
4. Check calling code (sync reports, ignore controllers) for identifier mix-ups

Example fix

// before: DN passed as identifier
$ignores->createOrFail('User', 'cn=jdoe,ou=people,dc=example,dc=com');
// after: passbolt UUID resolved from the user
$ignores->createOrFail('User', '9d8b0a1e-2f3c-4a5b-8c7d-6e5f4a3b2c1d');

use Cake\Validation\Validation;

if (!Validation::uuid($foreignKey)) {
    throw new \InvalidArgumentException('$foreignKey must be a passbolt UUID');
}
$ignores->createOrFail($foreignModel, $foreignKey);

$isValidUuid = is_string($foreignKey)
    && preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $foreignKey) === 1;

try {
    $ignores->createOrFail($foreignModel, $foreignKey);
} catch (BadRequestException $e) {
    if ($e->getMessage() === 'The identifier should be a valid UUID.') {
        $this->log("Invalid ignore identifier: {$foreignKey}", 'error');
    }
}

When it happens

Trigger: Calling createOrFail($foreignModel, $foreignKey) with a non-UUID $foreignKey — e.g. passing an LDAP DN, email, integer ID, or empty string instead of the passbolt user/group UUID.

Common situations: Custom scripts or report handlers passing LDAP entry identifiers instead of passbolt UUIDs when ignoring entries; integration code written before IDs became UUIDs; copy-paste of the wrong column value.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• Invalid id
• Please provide a valid request id.
• The authentication token id is invalid.
• The authentication token must be a valid UUID.
• The comment id is not valid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/b2887751e24ab10b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Model/Table/DirectoryIgnoreTable.php:188

            ],
        ]);
        $this->save($entity);

        return $entity;
    }

    /**
     * Create or fail
     *
     * @param string $foreignModel foreign model
     * @param string $foreignKey foreign key
     * @return \Passbolt\DirectorySync\Model\Entity\DirectoryIgnore|bool
     * @throws \Cake\Http\Exception\BadRequestException if the $foreignKey is not a valid UUID
     */
    public function createOrFail(string $foreignModel, string $foreignKey): bool|DirectoryIgnore
    {
        if (!Validation::uuid($foreignKey)) {
            throw new BadRequestException(__('The identifier should be a valid UUID.'));
        }
        try {
            $entry = $this->get($foreignKey);
        } catch (RecordNotFoundException $exception) {
        }
        if (isset($entry)) {
            throw new BadRequestException(__('This record is already marked as to be ignored.'));
        }

        $ignore = $this->newEntity(
            [
                'id' => $foreignKey,
                'foreign_model' => $foreignModel,
            ],
            [
                'accessibleFields' => [
                    'id' => true,
                    'foreign_model' => true,

View on GitHub (pinned to 31c1bbc10f)