passbolt/passbolt_api · error · BadRequestException

The SSO setting id should be a uuid.

Error message

The SSO setting id should be a uuid.

What it means

SsoSettingsDeleteService::delete() validates the settings id with Validation::uuid() before any permission check or lookup. A malformed id yields BadRequestException 'The SSO setting id should be a uuid.'

Solutions

1. Pass the settings entity UUID as returned by the API
2. Trim/validate the id client-side with a UUID check before calling delete()
3. Fix route/parameter extraction so the id comes from the correct request attribute

Example fix

// before
$service->delete($uac, $this->request->getParam('pass')[0]); // may be a slug
// after
$id = $this->request->getParam('pass')[0];
if (!Validation::uuid($id)) { throw new BadRequestException(__('The SSO setting id should be a uuid.')); }
$service->delete($uac, $id);

if (!Validation::uuid($id)) { throw new BadRequestException(__('The SSO setting id should be a uuid.')); }

function isUuid(?string $id): bool { return is_string($id) && (bool)preg_match('/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i', $id); }

try { $service->delete($uac, $id); } catch (BadRequestException $e) { // surface id format error to the client }

When it happens

Trigger: Calling delete($uac, $id) with an empty string, integer id, slug, or truncated UUID as $id.

Common situations: Frontend routing bugs passing URL segments instead of the id; legacy integer ids; copy/paste truncation; encoding artifacts (quotes, whitespace) around the id.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• The SSO setting id should be a uuid.
• Invalid status.
• The identifier should be a valid UUID.
• The identifier should be a valid UUID.
• The user id should be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7521fa230b7ced77. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsDeleteService.php:50

    /**
     * Event names
     */
    public const AFTER_DELETE_ACTIVE_SSO_SETTINGS_EVENT = 'sso.ssosettings.delete.active';

    /**
     * Delete a setting identified with its id
     *
     * @param \App\Utility\ExtendedUserAccessControl $uac user access control
     * @param string $id uuid setting id
     * @throws \Cake\Http\Exception\BadRequestException if $id is not a valid uuid
     * @throws \Cake\Http\Exception\NotFoundException if settings cannot be found
     * @throws \Cake\Http\Exception\InternalErrorException if the settings could not be deleted
     * @return void
     */
    public function delete(ExtendedUserAccessControl $uac, string $id): void
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The SSO setting id should be a uuid.'));
        }
        $uac->assertIsAdmin();

        $ssoSettingsTable = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoSettings');

        try {
            /** @var \Passbolt\Sso\Model\Entity\SsoSetting $ssoSetting */
            $ssoSetting = $ssoSettingsTable->find()->where(['id' => $id])->firstOrFail();
        } catch (RecordNotFoundException $exception) {
            throw new NotFoundException(__('The SSO setting does not exist.'), 404, $exception);
        }

        try {
            $ssoSettingsTable->deleteQuery()
                ->where(['id' => $id])
                ->execute();
        } catch (Exception $exception) {
            throw new InternalErrorException(__('Could not delete the SSO settings.'), 500, $exception);

View on GitHub (pinned to 31c1bbc10f)