passbolt/passbolt_api · error · BadRequestException

The settings status is invalid.

Error message

The settings status is invalid.

What it means

assertAndGetSettings() checks that the persisted settings row's status equals the requested status (STATUS_DRAFT for activation). If the stored status differs, a BadRequestException 'The settings status is invalid.' is thrown.

Solutions

1. Verify the settings current status via GET before activating; skip activation if already active
2. Create a fresh draft and activate that one instead of retrying the consumed one
3. Serialize the activation flow so only one admin can activate a given draft

Example fix

// before
$service->activate($uac, $id, $data); // may double-activate
// after
$setting = $settingsTable->get($id);
if ($setting->status !== SsoSetting::STATUS_DRAFT) { return; } // already handled
$service->activate($uac, $id, $data);

$setting = $settingsTable->get($id); if ($setting->status !== SsoSetting::STATUS_DRAFT) { return; // already activated }

try { $service->activate($uac, $id, $data); } catch (BadRequestException $e) { // status mismatch: re-fetch state and skip or restart }

When it happens

Trigger: Calling activate() on settings whose status is already 'active' (double activation), 'deleted', or otherwise not the required draft status expected by the flow.

Common situations: User clicks activate twice or a retry fires after the first activation succeeded; another admin activated the same draft concurrently; stale UI showing a draft that was already activated.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• Invalid status.
• The authentication token does not exist.
• The SSO setting id should be a uuid.
• The SSO setting id should be a uuid.
• The user is missing for the SSO state.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/36d86781219b7562. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsActivateService.php:134

     * @throws \Cake\Http\Exception\NotFoundException if the settings id is not found
     * @return \Passbolt\Sso\Model\Entity\SsoSetting
     */
    protected function assertAndGetSettings(string $id, string $status): SsoSetting
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The SSO setting id should be a uuid.'));
        }

        try {
                $this->SsoSettings = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoSettings');
            /** @var \Passbolt\Sso\Model\Entity\SsoSetting $ssoSettings */
            $ssoSettings = $this->SsoSettings->find()->where(['id' => $id])->firstOrFail();
        } catch (RecordNotFoundException $exception) {
            throw new NotFoundException(__('The SSO setting does not exist.'), 404, $exception);
        }

        if ($ssoSettings->status !== $status) {
            throw new BadRequestException(__('The settings status is invalid.'));
        }

        return $ssoSettings;
    }

    /**
     * @param array $data user provided data
     * @throws \Cake\Http\Exception\BadRequestException if status is invalid
     * @return void
     */
    protected function assertActiveStatus(array $data): void
    {
        if (!isset($data['status']) || $data['status'] !== SsoSetting::STATUS_ACTIVE) {
            throw new BadRequestException(__('Invalid status.'));
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)