passbolt/passbolt_api · error · BadRequestException

The user does not exist or is not active or is disabled.

Error message

The user does not exist or is not active or is disabled.

What it means

Thrown by UserGetService::getActiveNotDeletedNotDisabledOrFail when the user passed the active/not-deleted checks (getActiveNotDeletedOrFail) but its disabled flag is true. This service variant is used by authenticated flows that require a live, enabled account (e.g. settings, MFA setup, account recovery completion).

Solutions

1. Check the disabled column for the user ID in question.
2. Have an administrator re-enable the account before retrying.
3. In scripts, skip or flag disabled users instead of treating them as processable.
4. If the user believes this is wrong, check audit/roles history to see who disabled the account and why.

Example fix

// before
$user = $userGetService->getActiveNotDeletedNotDisabledOrFail($id); // 400

// after: pre-check and handle
$user = $this->Users->get($id);
if ($user->disabled) {
    return $this->error('account-disabled');
}

const u = await getUser(userId);
if (u.disabled || !u.active || u.deleted) {
  throw new Error(`User ${userId} not eligible: active=${u.active} deleted=${u.deleted} disabled=${u.disabled}`);
}

try {
  $user = $userGetService->getActiveNotDeletedNotDisabledOrFail($userId);
} catch (BadRequestException $e) {
  $this->handleInactiveOrDisabledUser($userId); // skip, flag, or re-enable
}

When it happens

Trigger: Any authenticated endpoint that resolves the target user via getActiveNotDeletedNotDisabledOrFail while the user row has disabled = true — e.g. account recovery completion or user detail lookups for a disabled account.

Common situations: Disabled user still holds a valid session/token and calls the API; a batch script processes user IDs that include disabled accounts; MFA brute-force protection disabled the account mid-flow.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• The user does not exist or is already active or is disabled.
• Account recovery case must be a string.
• Account recovery reason not supported.
• An array of arrays is expected.
• Few fields are missing for the V5.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/4b7a3fe17a533b9e. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Users/UserGetService.php:116

        return $userEntity;
    }

    /**
     * Get a user by ID or throw relevant HTTP exceptions
     *
     * @param string $userId user id uuid
     * @throws \Cake\Http\Exception\NotFoundException if the user could not be found
     * @throws \Cake\Http\Exception\BadRequestException if the userId is not a valid uuid
     * @throws \Cake\Http\Exception\BadRequestException if the is not active or deleted or disabled
     * @return \App\Model\Entity\User
     */
    public function getActiveNotDeletedNotDisabledOrFail(string $userId): User
    {
        $userEntity = $this->getActiveNotDeletedOrFail($userId);

        if ($userEntity->isDisabled()) {
            throw new BadRequestException(__('The user does not exist or is not active or is disabled.'));
        }

        return $userEntity;
    }

    /**
     * Get a user by ID or throw relevant HTTP exceptions
     *
     * @param string $userId user id uuid
     * @throws \Cake\Http\Exception\NotFoundException if the user could not be found
     * @throws \Cake\Http\Exception\BadRequestException if the userId is not a valid uuid
     * @throws \Cake\Http\Exception\BadRequestException if the is not active or deleted
     * @return \App\Model\Entity\User
     */
    public function getActiveNotDeletedOrFail(string $userId): User
    {
        $userEntity = $this->getOrFail($userId);
        $msg = __('The user does not exist or is not active or is disabled.');

View on GitHub (pinned to 31c1bbc10f)