passbolt/passbolt_api · error · BadRequestException

The user id is invalid.

Error message

The user id is invalid.

What it means

Thrown by getUacFromUserIdAndRequest() when the provided user_id fails CakePHP's Validation::uuid() check. The API requires a valid UUID v4-formatted user identifier before it will even look up the user. This is a cheap input-format guard ahead of the database lookup.

Solutions

1. Ensure user_id is a proper 36-character UUID (e.g. fetched from the users API)
2. Replace any usage of email/username with the user's uuid field
3. Trim whitespace and re-encode the value; check for truncation in client-side storage
4. Validate client-side with a UUID regex before sending

Example fix

// before
body: {user_id: 'admin@company.com'}
// after
body: {user_id: '52f3f602-eef0-4c6b-b6c4-c5d3b1a1e0aa'}

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
if (!UUID_RE.test(userId)) throw new Error('user_id must be a valid UUID');

function isUuid(v: unknown): v is string {
  return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
}

try {
  await startSsoStage1({user_id});
} catch (e) {
  if (e.response?.status === 400 && e.response?.data?.message?.includes('user id is invalid')) {
    // re-fetch the correct user uuid from the users API
  }
}

When it happens

Trigger: Calling stage1 with 'user_id' set to a non-UUID string such as 'me', 'admin@example.com', a numeric id, or a truncated/malformed uuid.

Common situations: Client passes the username or email instead of the user uuid; id came from an older database with integer keys; string got truncated or altered in transit (e.g. URL encoding bug).

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• The authentication token should be a valid UUID.
• The SSO setting id should be a uuid.
• The SSO setting id should be a uuid.
• The user id should be a valid UUID.
• " " is not a valid group id for filter .

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/97c340742e72b7a5. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Controller/AbstractSsoController.php:208

        $settingsId = $this->request->getData('sso_settings_id');
        if (!isset($settingsId) || !is_string($settingsId)) {
            throw new BadRequestException(__('The settings id is required in URL parameters.'));
        }

        return $settingsId;
    }

    /**
     * Get an extended user access control from a user id and request client info
     *
     * @param string $userId uuid
     * @throws \Cake\Http\Exception\BadRequestException if the userid is not valid or user does not exist or is inactive
     * @return \App\Utility\ExtendedUserAccessControl
     */
    public function getUacFromUserIdAndRequest(string $userId): ExtendedUserAccessControl
    {
        if (!Validation::uuid($userId)) {
            throw new BadRequestException(__('The user id is invalid.'));
        }

        try {
            $user = (new UserGetService())->getActiveNotDeletedNotDisabledOrFail($userId);
        } catch (NotFoundException $exception) {
            throw new BadRequestException(__('The user does not exist or is not active.'), 400, $exception);
        }

        return new ExtendedUserAccessControl(
            Role::GUEST,
            $user->id,
            $user->username,
            $this->User->ip(),
            $this->User->userAgent()
        );
    }

    /**

View on GitHub (pinned to 31c1bbc10f)