passbolt/passbolt_api · warning · BadRequestException

This functionality is only available using AJAX/JSON.

Error message

This functionality is only available using AJAX/JSON.

What it means

The JSON MFA API endpoints only accept AJAX/JSON requests. _assertRequestIsJson rejects any request not flagged as JSON (e.g. missing .json extension or JSON Accept header) with a BadRequestException, ensuring the response is machine-readable for API clients.

Solutions

1. Append .json to the endpoint URL
2. Send Accept: application/json (and appropriate Content-Type for POST)
3. Use the browser (non-JSON) flow for interactive MFA

Example fix

// before
await fetch('/mfa/verify/verify', {method:'POST'});
// after
await fetch('/mfa/verify/verify.json', {method:'POST', headers:{'Content-Type':'application/json'}});

if (!url.endsWith('.json')) url += '.json';
headers['Accept'] = 'application/json';

When it happens

Trigger: GET/POST to the JSON MFA endpoints without the .json URL extension or without Content-Type/Accept: application/json.

Common situations: Hitting the endpoint in a browser address bar; scripts forgetting the .json suffix used by Passbolt's CakePHP JSON view routing.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• This functionality is not available using AJAX/JSON.
• This is not a valid Ajax/Json request.
• No valid multi-factor authentication settings found.
• No valid multi-factor authentication settings found for…
• The multi-factor authentication is not required.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/6a9b05caa39221b0. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaController.php:96

     * @throw BadRequestException if the request is of json type.
     */
    protected function _assertRequestNotJson(): void
    {
        if ($this->getRequest()->is('json')) {
            throw new BadRequestException(__('This functionality is not available using AJAX/JSON.'));
        }
    }

    /**
     * Assert the request is of json type.
     *
     * @return void
     * @throw BadRequestException if the request is not of json type.
     */
    protected function _assertRequestIsJson(): void
    {
        if (!$this->getRequest()->is('json')) {
            throw new BadRequestException(__('This functionality is only available using AJAX/JSON.'));
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)