passbolt/passbolt_api · error · BadRequestException

The user does not exist, is already active or has been…

Error message

The user does not exist, is already active or has been deleted.

What it means

Setup completion requires the target user to exist and be inactive, not deleted, and not disabled. UserGetService's getNotActiveNotDeletedNotDisabledOrFail threw NotFoundException, which is converted here to a BadRequestException with this message. The vague wording deliberately does not reveal which of the three conditions failed.

Solutions

Check whether the user is already active in the database / admin UI; if so, log in instead of completing setup
Re-issue the registration token via the admin (resend invite) if the user was deleted or disabled
Verify the userId in the setup URL is the correct, full UUID
Confirm the user's deleted flag is false before retrying

Defensive patterns

Strategy: validation

Validate before calling

// check user state before attempting setup completion
$user = $this->Users->find()->where(['id' => $userId])->first();
$eligible = $user && !$user->active && !$user->deleted && !$user->disabled;

Try / catch

try {
    $user = $setupCompleteService->complete($userId);
} catch (\Cake\Http\Exception\BadRequestException $e) {
    if ($e->getMessage() === 'The user does not exist, is already active or has been deleted.') {
        // redirect to login or re-invite flow
    }
}

Prevention

Check the user's active/deleted/disabled flags before sending setup links
Re-issue invitations for deleted or disabled users
Never reuse old setup URLs after successful completion
Validate the userId UUID format client-side

When it happens

Trigger: POST /setup/complete with a userId that: was already completed (active), was deleted, is disabled, or never existed.

Common situations: Re-running setup after it already succeeded; replaying an old setup link; admin deleted the user between invite and completion; wrong user id copied from the email token URL.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/6f5536d9a4278f33. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Setup/SetupCompleteService.php:147

        return $user;
    }

    /**
     * Return the user for matching the requesting id
     *
     * @param string $userId the user uuid
     * @throws \Cake\Http\Exception\BadRequestException if the user id is not a valid uuid
     * @throws \Cake\Http\Exception\BadRequestException if the user was deleted, is already active or does not exist
     * @return \App\Model\Entity\User user entity
     */
    protected function getAndAssertUser(string $userId): User
    {
        try {
            return (new UserGetService())->getNotActiveNotDeletedNotDisabledOrFail($userId);
        } catch (NotFoundException $exception) {
            $msg = __('The user does not exist, is already active or has been deleted.');
            throw new BadRequestException($msg);
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)