passbolt/passbolt_api · error · BadRequestException

The resource identifier should be a valid UUID.

Error message

The resource identifier should be a valid UUID.

What it means

FavoritesAddController::add validates the $foreignKey path parameter with Cake's Validation::uuid() before marking the resource as favorite, throwing a BadRequestException (HTTP 400) if it is not a valid UUID. Favorites can only attach to resources identified by UUID.

Solutions

1. Fetch the resource id from the resource list endpoint and use its full 36-character UUID in the URL.
2. Validate the id client-side against the UUID regex before calling.
3. Check for truncation/whitespace when copying the id.
4. Use the correct route — the favorite endpoint expects the favorited resource's id, not the favorite id.

Example fix

// before
POST /favorites/123.json
// after
POST /favorites/8e3874ae-4b40-590b-bdc4-af70aa7202b3.json

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
if (!UUID_RE.test(resourceId)) {
  throw new Error(`Resource id must be a UUID, got: ${resourceId}`);
}

function isUuid(v: unknown): v is string {
  return typeof v === 'string' &&
    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
}

try {
  await api.post(`/favorites/${resourceId}.json`);
} catch (e) {
  if (e.response?.status === 400) {
    // re-fetch the resource list to obtain a valid UUID
  }
  throw e;
}

When it happens

Trigger: POST /favorites/<foreignKey>.json where <foreignKey> is not a UUID — e.g. a numeric id, a resource name, an empty string, or a truncated identifier.

Common situations: Clients storing integer ids from a different backend; slugs or labels pasted instead of ids; copy/paste truncating the UUID; old API versions that used numeric ids.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• The comment id is not valid.
• The group id is not valid.
• The group identifier should be a valid UUID.
• The identifier should be a valid UUID.
• The resource identifier should be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/08485f0b9cd2e86c. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Favorites/FavoritesAddController.php:43

class FavoritesAddController extends AppController
{
    /**
     * Mark a resource as favorite.
     *
     * @param string $foreignKey The identifier of the instance to mark as favorite.
     * @throws \Cake\Http\Exception\BadRequestException If the resource id is not valid
     * @throws \Cake\Http\Exception\NotFoundException If the resource does not exist
     * @throws \Cake\Http\Exception\NotFoundException If the resource is soft deleted
     * @throws \Cake\Http\Exception\NotFoundException If the user does not have access to the resource
     * @return void
     */
    public function add(string $foreignKey)
    {
        $this->assertJson();

        // Check request sanity
        if (!Validation::uuid($foreignKey)) {
            throw new BadRequestException(__('The resource identifier should be a valid UUID.'));
        }

        $result = (new FavoritesAddService())->add($this->User->getAccessControl(), $foreignKey);

        $this->success(__('The resource was marked as favorite.'), $result);
    }
}

View on GitHub (pinned to 31c1bbc10f)