passbolt/passbolt_api · error · BadRequestException

The request data is invalid: id missing.

Error message

The request data is invalid: id missing.

What it means

Required-field check in RbacsUpdateDtoCollection::assertEntry(): every entry in the RBAC update payload must include an 'id' key identifying the permission to change. Fires when an entry omits the id — the client cannot say which RBAC to update — so the request is rejected with HTTP 400; the payload must be resent with each entry containing a valid id.

Solutions

1. Add the id (valid UUID of the rbac) to each entry.
2. Check client serialization so the id key is not dropped or renamed.
3. Validate entries client-side before sending.
4. Fetch fresh rbacs from GET /rbacs to obtain correct ids.

Example fix

// before
{"control_function":"allow"}
// after
{"id":"d530aac7-1b7a-4f0d-9f0e-2c1b9a8d7e6f","control_function":"allow"}

foreach ($entries as $e) {
    if (!isset($e['id'])) {
        throw new InvalidArgumentException('rbacs update entry missing id');
    }
}

function hasId(mixed $e): bool {
    return is_array($e) && array_key_exists('id', $e);
}

try {
    $collection = new RbacsUpdateDtoCollection($data);
} catch (BadRequestException $e) {
    // entries must carry id
}

When it happens

Trigger: Sending an entry like {"control_function":"allow"} without an id in the PUT /rbacs/update body.

Common situations: Client building payloads from partially loaded data, a field named differently (e.g. rbacId), or object-to-array serialization dropping the id (e.g. casting an entity with hidden id).

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• The request data is invalid: control_function missing.
• The request data is empty.
• The request data is invalid: expected a collection.
• The request data is invalid: id invalid.
• The request data is invalid: invalid fields.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/8e2565a4e1a31e79. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Rbacs/src/Model/Dto/RbacsUpdateDtoCollection.php:127

        }

        $this->assertUniqueIds($data);
    }

    /**
     * Assert a given data entry
     *
     * @throw BadRequestException if entry doesn't match the expected format
     * @param array $entry entry {id:<uuid>, control_function:<string>}
     * @return void
     */
    public function assertEntry(array $entry): void
    {
        if (count($entry) > 2) {
            throw new BadRequestException(__('The request data is invalid: invalid fields.'));
        }
        if (!isset($entry['id'])) {
            throw new BadRequestException(__('The request data is invalid: id missing.'));
        }
        if (!is_string($entry['id']) || !Validation::uuid($entry['id'])) {
            throw new BadRequestException(__('The request data is invalid: id invalid.'));
        }
        if (!isset($entry['control_function'])) {
            throw new BadRequestException(__('The request data is invalid: control_function missing.'));
        }
        if (!is_string($entry['control_function']) || !Validation::ascii($entry['control_function'])) {
            throw new BadRequestException(__('The request data is invalid: control_function invalid.'));
        }
    }

    /**
     * Assert data contains only one occurence of each id
     *
     * @throw BadRequestException if multiple entries with same id is sent
     * @param array $data data [{id:<uuid>, control_function:<string>},...] where id values must be unique
     * @return void

View on GitHub (pinned to 31c1bbc10f)