passbolt/passbolt_api · warning · BadRequestException

The metadata session key identifier should be a UUID.

Error message

The metadata session key identifier should be a UUID.

What it means

Format guard in MetadataSessionKeyUpdateService::update(): the id argument does not pass Validation::uuid(), so the metadata session key identifier is malformed and the update is rejected with 400 before any form validation or lookup.

Solutions

1. Send a valid UUID v4 as the session key identifier
2. Obtain the id from the session key index/creation endpoint
3. Validate the id client-side before issuing the update request

Example fix

// before
$service->update($uac, $requestId, $data);
// after
if (!Validation::uuid($requestId)) { return 400; }
$service->update($uac, $requestId, $data);

if (!Validation::uuid($id)) { throw new InvalidArgumentException('id must be a UUID'); }

function isValidSessionKeyId(string $id): bool { return Validation::uuid($id); }

try { $service->update($uac, $id, $data); } catch (BadRequestException $e) { /* invalid id */ }

When it happens

Trigger: PUT/PATCH-style update call with an id that is not a valid UUID (empty string, numeric id, malformed identifier).

Common situations: Bad URL construction in clients, string concatenation losing part of the id, tests using dummy ids.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The metadata session key identifier should be a UUID.
• The identifier should be a valid UUID.
• The SSO setting id should be a uuid.
• Account recovery case must be a string.
• Could not validate the data.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/9c67538c00553cca. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php:54

{
    use LocatorAwareTrait;

    /**
     * Delete the given metadata session key.
     *
     * @param \App\Utility\UserAccessControl $uac UAC.
     * @param string $id The metadata session key identifier.
     * @param array $data non-empty array of user provided data
     * @throws \Cake\Http\Exception\BadRequestException
     * @throws \Cake\Http\Exception\NotFoundException
     * @throws \Cake\Http\Exception\ConflictException
     * @throws \App\Error\Exception\CustomValidationException
     * @return \Passbolt\Metadata\Model\Entity\MetadataSessionKey
     */
    public function update(UserAccessControl $uac, string $id, array $data): MetadataSessionKey
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The metadata session key identifier should be a UUID.'));
        }

        // 400 invalid user provided data, we expect [modified:<datetime>, data:<string>]
        $form = new MetadataSessionKeyUpdateForm();
        if (!$form->execute($data)) {
            throw new FormValidationException(__('Could not validate the data.'), $form);
        }
        $data = $form->getData();

        /** @var \Passbolt\Metadata\Model\Table\MetadataSessionKeysTable $metadataSessionKeysTable */
        $metadataSessionKeysTable = $this->fetchTable('Passbolt/Metadata.MetadataSessionKeys');

        try {
            /** @var \Passbolt\Metadata\Model\Entity\MetadataSessionKey $metadataSessionKey */
            $metadataSessionKey = $metadataSessionKeysTable
                ->find()
                ->where(['id' => $id, 'user_id' => $uac->getId()])
                ->firstOrFail();

View on GitHub (pinned to 31c1bbc10f)