passbolt/passbolt_api · error · BadRequestException

The SSO setting id should be a uuid.

Error message

The SSO setting id should be a uuid.

What it means

SsoSettingsGetService::getByIdOrFail() validates the SSO settings identifier before querying the database. If the id is not a valid UUID string it throws a BadRequestException because a non-UUID id can never match a settings record. This is an early input guard that keeps malformed identifiers from reaching the table query.

Solutions

1. Check the id string being passed; it must be a 36-char UUID (e.g. 7f3a...-...). Log the value before the call.
2. Use the id returned by the SSO settings create/list API responses rather than constructing one.
3. Guard with Validation::uuid($id) before calling, or skip the call when the id is empty.
4. If the record was recently created, re-fetch the settings list to get a valid persisted id.

Example fix

// before
$dto = $service->getByIdOrFail($data['provider']);
// after
if (!Validation::uuid($data['id'])) {
    throw new BadRequestException(__('Invalid settings id'));
}
$dto = $service->getByIdOrFail($data['id']);

if (!isset($id) || !is_string($id) || !Validation::uuid($id)) { throw new \InvalidArgumentException('Invalid SSO settings id'); }

$isValid = is_string($id) && (bool) preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $id);

try { $dto = $service->getByIdOrFail($id); } catch (BadRequestException $e) { // surface 400 to caller }

When it happens

Trigger: Calling getByIdOrFail() (or the GET /sso/settings/{id} API endpoint) with an id that is not a UUID, e.g. a truncated string, numeric id, or empty string.

Common situations: Client code storing or passing the wrong field (e.g. provider name instead of the settings id), copy-paste errors, or an older client building URLs from unpersisted/draft data without an id.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The identifier should be a valid UUID.
• The metadata session key identifier should be a UUID.
• The metadata session key identifier should be a UUID.
• The SSO key id should be a uuid.
• The SSO key id should be a uuid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/e143260cc9e5c3c9. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsGetService.php:47

use Passbolt\Sso\Model\Dto\SsoSettingsDefaultDto;
use Passbolt\Sso\Model\Dto\SsoSettingsDto;
use Passbolt\Sso\Model\Entity\SsoSetting;

class SsoSettingsGetService
{
    /**
     * Return a setting identified with its id
     *
     * @param string $id uuid
     * @throws \Cake\Http\Exception\BadRequestException if $id is not a valid uuid
     * @throws \Cake\Datasource\Exception\RecordNotFoundException if setting cannot be found
     * @throws \Cake\Http\Exception\InternalErrorException if there is an issue with settings data decryption
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    public function getByIdOrFail(string $id): SsoSettingsDto
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The SSO setting id should be a uuid.'));
        }

        try {
            return $this->getOrFail(['id' => $id], true);
        } catch (RecordNotFoundException $exception) {
            throw new RecordNotFoundException(__('The SSO setting does not exist.'), 404, $exception);
        }
    }

    /**
     * Get the currently active setting or return default setting (disabled)
     *
     * @param bool $withData with settings data, e.g. provider specific data
     * @return \Passbolt\Sso\Model\Dto\AbstractSsoSettingsDto
     */
    public function getActiveOrDefault(?bool $withData = false): AbstractSsoSettingsDto
    {
        try {

View on GitHub (pinned to 31c1bbc10f)