passbolt/passbolt_api · error · BadRequestException

The request data is invalid: control_function missing.

Error message

The request data is invalid: control_function missing.

What it means

Required-field check in RbacsUpdateDtoCollection::assertEntry(): each RBAC update entry must include a 'control_function' key specifying the permission being set. Fires when an entry supplies an id but omits control_function, leaving nothing to update, so the request is rejected with HTTP 400 and must be resent with both fields per entry.

Solutions

1. Include control_function (string, ASCII, e.g. allow/deny) in each entry.
2. Fix key naming to the exact snake_case control_function.
3. Add client-side validation for required keys before submitting.
4. Consult the rbacs update API schema for accepted control_function values.

Example fix

// before
{"id":"d530aac7-1b7a-4f0d-9f0e-2c1b9a8d7e6f"}
// after
{"id":"d530aac7-1b7a-4f0d-9f0e-2c1b9a8d7e6f","control_function":"allow"}

foreach ($entries as $e) {
    if (!isset($e['control_function']) || !is_string($e['control_function'])) {
        throw new InvalidArgumentException('rbacs update entry missing control_function');
    }
}

function hasControlFunction(mixed $e): bool {
    return is_array($e) && isset($e['control_function']) && is_string($e['control_function']);
}

try {
    $collection = new RbacsUpdateDtoCollection($data);
} catch (BadRequestException $e) {
    // entries must carry control_function
}

When it happens

Trigger: Sending an entry with only an id, e.g. {"id":"<uuid>"}, or with the key misspelled (controlFunction, control_function omitted) in the PUT /rbacs/update body.

Common situations: Client only sending toggled ids and expecting the server to infer the value, camelCase/snake_case mismatch after client refactor, or building entries from incomplete objects.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• The request data is invalid: id missing.
• The request data is empty.
• The request data is invalid: expected a collection.
• The request data is invalid: id invalid.
• The request data is invalid: invalid fields.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/56bd4e01ead1258e. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Rbacs/src/Model/Dto/RbacsUpdateDtoCollection.php:133

     * Assert a given data entry
     *
     * @throw BadRequestException if entry doesn't match the expected format
     * @param array $entry entry {id:<uuid>, control_function:<string>}
     * @return void
     */
    public function assertEntry(array $entry): void
    {
        if (count($entry) > 2) {
            throw new BadRequestException(__('The request data is invalid: invalid fields.'));
        }
        if (!isset($entry['id'])) {
            throw new BadRequestException(__('The request data is invalid: id missing.'));
        }
        if (!is_string($entry['id']) || !Validation::uuid($entry['id'])) {
            throw new BadRequestException(__('The request data is invalid: id invalid.'));
        }
        if (!isset($entry['control_function'])) {
            throw new BadRequestException(__('The request data is invalid: control_function missing.'));
        }
        if (!is_string($entry['control_function']) || !Validation::ascii($entry['control_function'])) {
            throw new BadRequestException(__('The request data is invalid: control_function invalid.'));
        }
    }

    /**
     * Assert data contains only one occurence of each id
     *
     * @throw BadRequestException if multiple entries with same id is sent
     * @param array $data data [{id:<uuid>, control_function:<string>},...] where id values must be unique
     * @return void
     */
    public function assertUniqueIds(array $data): void
    {
        $unique = array_unique(Hash::extract($data, '{n}.id'));
        if (count($unique) != count($data)) {
            throw new BadRequestException(__('The request data is invalid: ids must be unique.'));

View on GitHub (pinned to 31c1bbc10f)