passbolt/passbolt_api · warning · BadRequestException

The metadata session key identifier should be a UUID.

Error message

The metadata session key identifier should be a UUID.

What it means

MetadataSessionKeyDeleteService::delete() validates the session key id with Validation::uuid() before querying. A non-UUID id means a malformed identifier was supplied by the client, so the request is rejected as a 400 Bad Request before any database lookup.

Solutions

1. Pass a valid UUID v4 identifier as the session key id
2. Fetch the id from the metadata session key creation/index endpoint rather than hardcoding
3. Validate the id with Validation::uuid($id) or a regex on the client before calling

Example fix

// before
$service->delete($uac, $idFromUrl);
// after
if (!Validation::uuid($idFromUrl)) { throw new InvalidArgumentException('invalid id'); }
$service->delete($uac, $idFromUrl);

if (!preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $id)) { throw new InvalidArgumentException('id must be a UUID'); }

function isUuid(string $id): bool { return preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $id) === 1; }

try { $service->delete($uac, $id); } catch (BadRequestException $e) { /* non-UUID id */ }

When it happens

Trigger: Calling DELETE on the metadata session key endpoint with an id that is not a valid UUID (e.g. truncated id, integer, empty string, or a differently-formatted identifier).

Common situations: Client stored an id from a wrong source, manually constructed URLs with non-UUID identifiers, or integration tests passing placeholder strings like 'xxx'.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The metadata session key identifier should be a UUID.
• The identifier should be a valid UUID.
• The SSO setting id should be a uuid.
• Account recovery case must be a string.
• Could not validate the data.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/019f71ce255a633e. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyDeleteService.php:41

use Cake\Http\Exception\NotFoundException;
use Cake\ORM\Locator\LocatorAwareTrait;
use Cake\Validation\Validation;

class MetadataSessionKeyDeleteService
{
    use LocatorAwareTrait;

    /**
     * Delete the given metadata session key.
     *
     * @param \App\Utility\UserAccessControl $uac UAC.
     * @param string $id The metadata session key identifier.
     * @return void
     */
    public function delete(UserAccessControl $uac, string $id): void
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The metadata session key identifier should be a UUID.'));
        }

        /** @var \Passbolt\Metadata\Model\Table\MetadataSessionKeysTable $metadataSessionKeysTable */
        $metadataSessionKeysTable = $this->fetchTable('Passbolt/Metadata.MetadataSessionKeys');

        try {
            /** @var \Passbolt\Metadata\Model\Entity\MetadataSessionKey $metadataSessionKey */
            $metadataSessionKey = $metadataSessionKeysTable
                ->find()
                ->where(['id' => $id, 'user_id' => $uac->getId()])
                ->firstOrFail();
        } catch (RecordNotFoundException $e) {
            throw new NotFoundException(__('The metadata session key does not exist or does not belong to this user.')); // phpcs:ignore
        }

        if ($metadataSessionKeysTable->delete($metadataSessionKey)) {
            return;
        }

View on GitHub (pinned to 31c1bbc10f)