passbolt/passbolt_api · error · BadRequestException

The SSO key id should be a uuid.

Error message

The SSO key id should be a uuid.

What it means

Thrown by SsoKeysDeleteController::delete() when the {id} route parameter is not a valid UUID. The key id path segment must be a uuid before SsoKeysDeleteService attempts deletion; anything else is rejected with a 400.

Solutions

1. Pass the SSO key's uuid as returned by the SSO keys list/create endpoints
2. Fix client URL interpolation — log the final URL to catch 'undefined' ids
3. Validate the id with a UUID regex before issuing the DELETE
4. Check for double-encoding or truncation of the id in transit

Example fix

// before
await api.delete(`/sso/keys/${key.numeric_id}`);
// after
await api.delete(`/sso/keys/${key.id}`); // key.id = 'e3b0c442-98fc-...uuid'

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
if (!UUID_RE.test(keyId)) throw new Error(`SSO key id must be a uuid, got: ${keyId}`);

function isUuid(v: unknown): v is string {
  return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
}

try {
  await deleteSsoKey(keyId);
} catch (e) {
  if (e.response?.status === 400 && e.response?.data?.message?.includes('should be a uuid')) {
    // re-fetch the key list to get valid uuid ids
  }
}

When it happens

Trigger: DELETE /sso/keys/<id> where <id> is an integer, a name like 'my-key', an empty string, or a malformed/truncated uuid.

Common situations: Client stored key id from a different API shape (numeric primary key); URL interpolation bug producing 'undefined' or 'null' in the path; copy-paste with trailing characters.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• The SSO key id should be a uuid.
• The SSO setting id should be a uuid.
• The SSO setting id should be a uuid.
• The SSO setting id should be a uuid.
• The user id should be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/9d287e80c7bbc2b4. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Controller/Keys/SsoKeysDeleteController.php:35

namespace Passbolt\Sso\Controller\Keys;

use App\Controller\AppController;
use Cake\Http\Exception\BadRequestException;
use Cake\Validation\Validation;
use Passbolt\Sso\Service\SsoKeys\SsoKeysDeleteService;

class SsoKeysDeleteController extends AppController
{
    /**
     * Delete a given SSO Passphrase Key
     *
     * @param string $id uuid key id
     * @return void
     */
    public function delete(string $id): void
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The SSO key id should be a uuid.'));
        }

        $uac = $this->User->getAccessControl();
        (new SsoKeysDeleteService())->delete($uac, $id);

        $this->success(__('The operation was successful'));
    }
}

View on GitHub (pinned to 31c1bbc10f)