passbolt/passbolt_api · warning · BadRequestException

This is not a valid Ajax/Json request.

Error message

This is not a valid Ajax/Json request.

What it means

The MFA organization settings GET endpoint is a JSON-only admin API. MfaOrgSettingsGetController::get asserts the request is JSON (after admin authorization) and throws BadRequestException for plain HTML/browser requests, because it returns configuration data rather than a page.

Solutions

1. Request /mfa/settings.json or send Accept: application/json
2. Ensure the caller is an admin (assertIsAdmin runs first and fails otherwise)
3. Use the admin UI for interactive organization settings management

Example fix

// before
await fetch('/mfa/settings');
// after
await fetch('/mfa/settings.json', {headers:{Accept:'application/json'}});

if (!url.endsWith('.json')) url += '.json';
headers['Accept'] = 'application/json';

When it happens

Trigger: GET /mfa/settings without the .json extension or without JSON Accept headers, even when authenticated as admin.

Common situations: Opening the endpoint in a browser; scripts omitting the .json suffix; proxies stripping Accept headers.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• This functionality is not available using AJAX/JSON.
• This functionality is only available using AJAX/JSON.
• Invalid MFA org settings.
• No configuration set for Yubikey OTP clientId.
• No configuration set for Yubikey OTP secret key.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/332b24a84ca60321. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Controller/OrgSettings/MfaOrgSettingsGetController.php:35

namespace Passbolt\MultiFactorAuthentication\Controller\OrgSettings;

use Cake\Http\Exception\BadRequestException;
use Passbolt\MultiFactorAuthentication\Controller\MfaController;
use Passbolt\MultiFactorAuthentication\Utility\MfaOrgSettingsDuoBackwardCompatible;

class MfaOrgSettingsGetController extends MfaController
{
    /**
     * Handle Org Settings get request
     *
     * @return void
     */
    public function get()
    {
        $this->User->assertIsAdmin();

        if (!$this->request->is('json')) {
            throw new BadRequestException(__('This is not a valid Ajax/Json request.'));
        }
        $config = $this->mfaSettings->getOrganizationSettings()->getConfig();
        /** TODO: Remove this line and its class once the frontend has been updated to use the new format/names */
        $config = MfaOrgSettingsDuoBackwardCompatible::remapGetDuoSettings($config);

        $this->success(__('The operation was successful.'), $config);
    }
}

View on GitHub (pinned to 31c1bbc10f)