passbolt/passbolt_api · error · NotFoundException

The SSO key does not exist.

Error message

The SSO key does not exist.

What it means

After validating the UUID, delete() looks up the SSO key scoped to both its id and the current user id (user_id = uac->getId()) and throws NotFoundException('The SSO key does not exist.') when firstOrFail() raises RecordNotFoundException. The scoping means a key belonging to another user is indistinguishable from a nonexistent key.

Solutions

1. Confirm the key id exists and belongs to the authenticated user (query the sso_keys table with id + user_id)
2. Refresh the key list in the client before retrying so stale ids are dropped
3. Make delete idempotent client-side: treat 404 for already-deleted keys as success
4. Verify you are connected to the intended passbolt instance (staging vs prod)

Example fix

// before: delete blindly on retry
await deleteKey(id); // 404 on second attempt
// after
try { await deleteKey(id); } catch (e) { if (e.status === 404) return; throw e; }

// pre-check existence and ownership
$key = $SsoKeys->find()->where(['id' => $id, 'user_id' => $uac->getId()])->first();
if (!$key) {
    // skip delete or refresh key list
}

try {
    $service->delete($uac, $id);
} catch (NotFoundException $e) {
    // treat as already-deleted; make retries idempotent
    return;
}

When it happens

Trigger: Deleting an already-deleted SSO key, using a key id that exists but belongs to a different user, or referencing a key on the wrong instance/database.

Common situations: Double DELETE from a retrying client; stale UI cache listing a removed key; multi-user testing where the key was created by another account; pointing the client at a different passbolt environment.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• The SSO key does not exist.
• The authentication token does not exist or has been deleted.
• The authentication token does not exist.
• The metadata session key does not exist or does not belong…
• The password expiry setting does not exist.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/1afc6f9ae2a39ec7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoKeys/SsoKeysDeleteService.php:46

{
    /**
     * Delete a Sso key
     *
     * @param \App\Utility\UserAccessControl $uac user access control
     * @param string $id uuid
     * @return void
     */
    public function delete(UserAccessControl $uac, string $id): void
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The SSO key id should be a uuid.'));
        }

        $SsoKeys = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoKeys');
        try {
            $entity = $SsoKeys->find()->where(['id' => $id, 'user_id' => $uac->getId()])->firstOrFail();
        } catch (RecordNotFoundException $exception) {
            throw new NotFoundException(__('The SSO key does not exist.'));
        }

        if (!$SsoKeys->delete($entity)) {
            throw new InternalErrorException(__('The SSO key could not be deleted.'));
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)