passbolt/passbolt_api · error · Cake\Http\Exception\BadRequestException

The SCIM setting id should be a valid UUID.

Error message

The SCIM setting id should be a valid UUID.

What it means

BadRequestException raised in ScimDeleteSettingsController::deleteSettings when the SCIM settings id in the URL fails CakePHP's Validation::uuid() check. SCIM setting identifiers must be valid UUIDs; anything else is rejected before the deletion service is invoked.

Solutions

1. Fetch the SCIM settings list and use the actual UUID id of the settings record in the DELETE URL
2. Validate the id is a UUID string before building the request URL
3. Check the response of the GET settings endpoint / migration output for the correct identifier format

Example fix

// before
delete('/scim/settings/latest.json');
// after
const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
if (UUID_RE.test(id)) delete(`/scim/settings/${id}.json`);

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
if (!UUID_RE.test(id)) throw new Error(`Not a valid SCIM settings UUID: ${id}`);

const isUuid = (v: unknown): v is string => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);

try { await deleteScimSettings(id); } catch (e) { if (e.status === 400) throw new Error(`Invalid SCIM settings id: ${id}`); throw e; }

When it happens

Trigger: DELETE request to a SCIM settings endpoint whose {id} path segment is not a UUID (e.g. 'latest', a numeric id, an empty or truncated string).

Common situations: Client substitutes a SCIM setting name or a database auto-increment id instead of the UUID; copy/paste truncated the UUID; constructing the URL from a wrong record field after an API version change.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• The SCIM setting identifier should be a valid UUID.
• Invalid id
• Please provide a valid request id.
• The account recovery request identifier should be a valid…
• The authentication token id is invalid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/1c4a5af865d6daef. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Controller/ScimDeleteSettingsController.php:39

use Cake\Validation\Validation;
use Passbolt\Scim\Service\ScimDeleteSettingsService;

class ScimDeleteSettingsController extends AppController
{
    /**
     * SCIM DELETE action
     *
     * @param string|null $id ID of the setting to delete
     * @return void
     */
    public function deleteSettings(?string $id): void
    {
        $this->assertJson();
        $this->User->assertIsAdmin();

        // Check request sanity
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The SCIM setting id should be a valid UUID.'));
        }

        $service = new ScimDeleteSettingsService();
        $service->deleteSettings($this->User->getAccessControl(), $id);
        $this->success(__('The operation was successful.'));
    }
}

View on GitHub (pinned to 31c1bbc10f)