passbolt/passbolt_api · error · BadRequestException

The request data is invalid: id invalid.

Error message

The request data is invalid: id invalid.

What it means

Type/format check in RbacsUpdateDtoCollection::assertEntry(): the 'id' of each RBAC update entry must be a string holding a valid UUID. Fires when the id is present but not a string or not a UUID (e.g. an integer or garbage value), so the entry cannot reference an existing RBAC row and the update is rejected with HTTP 400.

Solutions

1. Send a proper RFC 4122 UUID string for the rbac id.
2. Fix the client to use the id field from GET /rbacs responses verbatim.
3. Add client-side UUID format validation before submitting.
4. Confirm you are not substituting role id or numeric keys for the rbac id.

Example fix

// before
{"id": 42, "control_function":"allow"}
// after
{"id":"d530aac7-1b7a-4f0d-9f0e-2c1b9a8d7e6f","control_function":"allow"}

use Cake\Validation\Validation;
foreach ($entries as $e) {
    if (!isset($e['id']) || !is_string($e['id']) || !Validation::uuid($e['id'])) {
        throw new InvalidArgumentException('rbacs update id must be a UUID string');
    }
}

function isUuidString(mixed $v): bool {
    return is_string($v) && preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i', $v) === 1;
}

try {
    $collection = new RbacsUpdateDtoCollection($data);
} catch (BadRequestException $e) {
    // id format invalid: re-fetch ids
}

When it happens

Trigger: Sending id as an integer, null, empty string, or a non-UUID string (e.g. "123", "abc", a role name) in the PUT /rbacs/update body.

Common situations: Client using database auto-increment ids instead of UUIDs, ids truncated or mangled by string handling, or passing the role id instead of the rbac id.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• Record not found
• The authentication token id is invalid.
• The rbacs could not be saved.
• The request data is empty.
• The request data is invalid: control_function missing.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/c23c4b98a585e6ea. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Rbacs/src/Model/Dto/RbacsUpdateDtoCollection.php:130

    }

    /**
     * Assert a given data entry
     *
     * @throw BadRequestException if entry doesn't match the expected format
     * @param array $entry entry {id:<uuid>, control_function:<string>}
     * @return void
     */
    public function assertEntry(array $entry): void
    {
        if (count($entry) > 2) {
            throw new BadRequestException(__('The request data is invalid: invalid fields.'));
        }
        if (!isset($entry['id'])) {
            throw new BadRequestException(__('The request data is invalid: id missing.'));
        }
        if (!is_string($entry['id']) || !Validation::uuid($entry['id'])) {
            throw new BadRequestException(__('The request data is invalid: id invalid.'));
        }
        if (!isset($entry['control_function'])) {
            throw new BadRequestException(__('The request data is invalid: control_function missing.'));
        }
        if (!is_string($entry['control_function']) || !Validation::ascii($entry['control_function'])) {
            throw new BadRequestException(__('The request data is invalid: control_function invalid.'));
        }
    }

    /**
     * Assert data contains only one occurence of each id
     *
     * @throw BadRequestException if multiple entries with same id is sent
     * @param array $data data [{id:<uuid>, control_function:<string>},...] where id values must be unique
     * @return void
     */
    public function assertUniqueIds(array $data): void
    {

View on GitHub (pinned to 31c1bbc10f)