passbolt/passbolt_api · error · Cake\Http\Exception\BadRequestException

The user identifier should be a valid UUID.

Error message

The user identifier should be a valid UUID.

What it means

BadRequestException thrown by AccountRecoveryRequestCreateService::assertUserId when the `user_id` field submitted in an account recovery request creation is not a valid UUID. It is a first-line input validation so that malformed identifiers never reach the database layer.

Solutions

1. Send a valid UUID in `user_id` (36-char, 8-4-4-4-12 format)
2. Look up the user's id first, e.g. via the users API by username
3. Check the client version/payload serialization matches the passbolt API schema

Example fix

// before
POST {"user_id": "ada@example.com"}
// after
POST {"user_id": "54c3d2ae-1d10-46c8-a7f1-1a25dc5b079c"}

if (!preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $userId)) { throw new \InvalidArgumentException('user_id must be a UUID'); }

function isUuid(?string $v): bool { return is_string($v) && (bool)preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $v); }

try { $service->create($data); } catch (BadRequestException $e) { if ($e->getMessage() contains 'valid UUID') { correctPayload(); } }

When it happens

Trigger: POST to /account-recovery/requests (via AccountRecoveryRequestCreateService::create) with a `user_id` that is missing, empty, an integer, or any string that fails CakePHP Validation::uuid().

Common situations: Client sends the username/email instead of the user UUID; a truncated or URL-decoded id; an older client API version posting a different payload shape; manual API testing with an arbitrary string.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• Please provide a valid request id.
• The authentication token id is invalid.
• The request id is invalid.
• The request id is invalid.
• $exception->getMessage() (dynamic, from wrapped…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/eeb71b9793372eff. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryRequests/AccountRecoveryRequestCreateService.php:133

    public function assertPolicyIsEnabled(): void
    {
        $service = new AccountRecoveryOrganizationPolicyGetService();
        $policy = $service->get();
        if ($policy->isDisabled()) {
            $msg = __('Recovery request cannot be created when organization policy is disabled.');
            throw new BadRequestException($msg);
        }
    }

    /**
     * @throws \Cake\Http\Exception\BadRequestException if user id is not valid
     * @return string uuid
     */
    public function assertUserId(): string
    {
        $userId = $this->getData('user_id');
        if (!Validation::uuid($userId)) {
            throw new BadRequestException(__('The user identifier should be a valid UUID.'));
        }

        return $userId;
    }

    /**
     * @throws \Cake\Http\Exception\BadRequestException if organization policy is disabled
     * @return void
     */
    public function assertUserIsEnrolled(): void
    {
        $service = new AccountRecoveryUserSettingsGetService();
        $userSettings = $service->get($this->getData('user_id'));
        if (!isset($userSettings) || $userSettings->isRejected()) {
            $msg = __('Recovery request cannot be created when user is not enrolled.');
            throw new BadRequestException($msg);
        }
    }

View on GitHub (pinned to 31c1bbc10f)