passbolt/passbolt_api · error · BadRequestException

The SSO key id should be a uuid.

Error message

The SSO key id should be a uuid.

What it means

SsoKeysDeleteService::delete() requires the SSO key id parameter to be a valid UUID and throws BadRequestException('The SSO key id should be a uuid.') when Validation::uuid() fails. It is a cheap input guard before any database access.

Solutions

1. Pass the full UUID of the SSO key as returned by the SSO keys listing endpoint
2. Fix client-side code that builds the URL so the id placeholder is populated
3. Validate the id format client-side before issuing the DELETE request
4. Check for double URL-encoding that corrupts the id

Example fix

// before
await fetch(`/sso/keys/${key.rowNumber}`, {method: 'DELETE'});
// after
await fetch(`/sso/keys/${key.id}`, {method: 'DELETE'}); // key.id is a UUID

// pre-validate the id client-side
if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(keyId)) {
    throw new Error('SSO key id must be a UUID');
}

try {
    $service->delete($uac, $id);
} catch (BadRequestException $e) {
    // invalid id format — fix client URL building
    throw $e;
}

When it happens

Trigger: Calling the delete endpoint/service with an id that is not a UUID: empty string, numeric id, URL-encoded garbage, or a truncated identifier from a client-side bug.

Common situations: Client code passes a route parameter placeholder that never got substituted; using a database row number instead of the UUID; copy/paste truncation of the key id.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The SSO key id should be a uuid.
• The SSO setting id should be a uuid.
• The SSO setting id should be a uuid.
• The SSO setting id should be a uuid.
• The user id should be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/bef370f9a0eddcd0. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoKeys/SsoKeysDeleteService.php:39

use Cake\Http\Exception\BadRequestException;
use Cake\Http\Exception\InternalErrorException;
use Cake\Http\Exception\NotFoundException;
use Cake\ORM\TableRegistry;
use Cake\Validation\Validation;

class SsoKeysDeleteService
{
    /**
     * Delete a Sso key
     *
     * @param \App\Utility\UserAccessControl $uac user access control
     * @param string $id uuid
     * @return void
     */
    public function delete(UserAccessControl $uac, string $id): void
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The SSO key id should be a uuid.'));
        }

        $SsoKeys = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoKeys');
        try {
            $entity = $SsoKeys->find()->where(['id' => $id, 'user_id' => $uac->getId()])->firstOrFail();
        } catch (RecordNotFoundException $exception) {
            throw new NotFoundException(__('The SSO key does not exist.'));
        }

        if (!$SsoKeys->delete($entity)) {
            throw new InternalErrorException(__('The SSO key could not be deleted.'));
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)