passbolt/passbolt_api · error · BadRequestException

The request data is invalid: expected a collection.

Error message

The request data is invalid: expected a collection.

What it means

Structure guard in RbacsUpdateDtoCollection::assertdata(): one of the entries in the request data is not an array, i.e. the payload is not the expected collection of {id, control_function} objects, so a 400 is raised.

Solutions

1. Ensure every item in the request body is an object with id and control_function keys.
2. Fix the client payload structure to match [{"id":"<uuid>","control_function":"<string>"}].
3. Validate payload shape before sending (e.g. JSON schema check).
4. On the server, decode the body as a JSON object list rather than a plain array.

Example fix

// before
[{"d530aac7-..."}, {"9e3f5b2a-..."}]
// after
[{"id":"d530aac7-...","control_function":"allow"},{"id":"9e3f5b2a-...","control_function":"deny"}]

if (array_filter($data, fn($e) => !is_array($e))) {
    throw new InvalidArgumentException('each rbacs update entry must be an object');
}

function isRbacEntry(mixed $entry): bool {
    return is_array($entry) && isset($entry['id'], $entry['control_function']);
}
if (!allEntriesAreRbacEntries($data)) { throw new InvalidArgumentException('bad payload'); }

try {
    $collection = new RbacsUpdateDtoCollection($data);
} catch (BadRequestException $e) {
    // payload shape wrong: inspect entries
}

When it happens

Trigger: Passing data where one or more items are scalars, strings, or null — e.g. ["abc"] or [null] instead of [["id"=>..., "control_function"=>...]] — typically when the JSON body is a flat list of ids or malformed.

Common situations: Client sending [{"id": ...}] vs a bare array of id strings, JSON body structure mismatch after API change, or server-side callers passing decoded data of the wrong shape.

Related errors

• The request data is invalid: invalid fields.
• The request data is empty.
• The request data is invalid: control_function missing.
• The request data is invalid: id invalid.
• The request data is invalid: id missing.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/82af23397b066b7a. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Rbacs/src/Model/Dto/RbacsUpdateDtoCollection.php:106

    {
        return count($this->data);
    }

    /**
     * Assert the whole data set is correct
     *
     * @throw BadRequestException if data is invalid
     * @param array $data data [{id:<uuid>, control_function:<string>},...]
     * @return void
     */
    public function assertdata(array $data): void
    {
        if (!count($data)) {
            throw new BadRequestException(__('The request data is empty.'));
        }
        foreach ($data as $entry) {
            if (!is_array($entry)) {
                throw new BadRequestException(__('The request data is invalid: expected a collection.'));
            }
            $this->assertEntry($entry);
        }

        $this->assertUniqueIds($data);
    }

    /**
     * Assert a given data entry
     *
     * @throw BadRequestException if entry doesn't match the expected format
     * @param array $entry entry {id:<uuid>, control_function:<string>}
     * @return void
     */
    public function assertEntry(array $entry): void
    {
        if (count($entry) > 2) {
            throw new BadRequestException(__('The request data is invalid: invalid fields.'));

View on GitHub (pinned to 31c1bbc10f)