passbolt/passbolt_api · error · ValidationException

The request is invalid.

Error message

The request is invalid.

What it means

A ValidationException thrown when the account recovery request entity built in buildAndValidateEntity fails the table's validation rules (e.g. invalid user_id, status value, or missing required fields). The entity with its errors is attached to the exception.

Solutions

1. Inspect the attached entity errors to identify the failing field.
2. Use the official POST /account-recovery/requests endpoint with only user_id in the payload.
3. Ensure the user exists and the id is a valid UUID.
4. Align client/server versions so status values match the supported enum.

Example fix

// before
Table.save({user_id: userId, status: 'pending', foo: 'bar'});
// after
Table.save({user_id: userId}); // status managed by the server

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
if (!userId || !UUID_RE.test(userId)) throw new Error('user id must be a UUID');

function isUuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v); }

try { await api.startAccountRecovery({user_id: userId}); } catch (e) { if (e.body && e.body.account_recovery_request) { reportFieldErrors(e.body.account_recovery_request); } else { throw e; } }

When it happens

Trigger: Creating a recovery request with a non-existent/invalid user_id, an unsupported status string, or missing created_by/modified_by fields.

Common situations: Starting account recovery for a user id that fails entity-level validation; custom integrations posting request entities directly; status enum drift between client and server versions.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not validate password data.
• Could not validate policy data.
• The account recovery request response is invalid.
• Could not save the account recovery private key.
• Could not save the account recovery setting.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7578dfef1c9b6546. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Model/Table/AccountRecoveryRequestsTable.php:428

            'armored_key' => $data['armored_key'] ?? '',
            'fingerprint' => $data['fingerprint'] ?? '',
            'status' => AccountRecoveryRequest::ACCOUNT_RECOVERY_REQUEST_PENDING,
            'created_by' => $uac->getId(),
            'modified_by' => $uac->getId(),
        ], [
            'accessibleFields' => [
                'authentication_token_id' => true,
                'user_id' => true,
                'armored_key' => true,
                'fingerprint' => true,
                'status' => true,
                'created_by' => true,
                'modified_by' => true,
            ],
        ]);

        if ($requestEntity->getErrors()) {
            throw new ValidationException(__('The request is invalid.'), $requestEntity, $this);
        }

        return $requestEntity;
    }

    /**
     * Patch a request from a response
     *
     * @param \App\Utility\UserAccessControl $uac user access control
     * @param \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryRequest $requestEntity request
     * @param string $responseStatus data
     * @return \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryRequest
     */
    public function updateStatusAndValidateEntity(
        UserAccessControl $uac,
        AccountRecoveryRequest $requestEntity,
        string $responseStatus
    ): AccountRecoveryRequest {

View on GitHub (pinned to 31c1bbc10f)