passbolt/passbolt_api · error · BadRequestException

Unable to authenticate the guest user with the provided…

Error message

Unable to authenticate the guest user with the provided credentials. No registration authentication token found for the given user.

What it means

This BadRequestException is thrown while authenticating an anonymous (guest) caller of the user key policies settings endpoint. After validating that user_id and token are UUIDs, the controller looks up a registration-type token via AuthenticationTokenGetService::getActiveNotExpiredOrFail; when no token record matches (NotFoundException), it throws BadRequestException with the appended message 'No registration authentication token found for the given user.'. It prevents guests from reading key policy settings without valid register-flow credentials.

Solutions

1. Verify the token in the database: SELECT * FROM authentication_tokens WHERE id = '<token>' AND user_id = '<user_id>' AND type = 'register';
2. Re-open the original registration/setup invitation link to get a fresh valid token for the correct user.
3. Regenerate a registration token for the user via the register flow and retry with that token.
4. Ensure user_id and token belong to the same user and were not swapped.

Example fix

// before (client)
GET /user-key-policies/settings?user_id=<uuid-user-a>&token=<token-of-user-b>
// after
GET /user-key-policies/settings?user_id=<uuid-user-a>&token=<register-token-issued-to-user-a>

const uuid = (v) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
if (!uuid(userId) || !uuid(token)) throw new Error('invalid params');
// then confirm server-side the token exists:
// SELECT 1 FROM authentication_tokens WHERE id = ? AND user_id = ? AND type = 'register' AND active = 1

function isValidRegisterTokenPayload(p) {
  return typeof p === 'object' && p !== null &&
    isUuid(p.user_id) && isUuid(p.token);
}

try {
  await get('/user-key-policies/settings', { user_id, token });
} catch (e) {
  if (e.status === 400 && /No registration authentication token found/.test(e.message)) {
    // restart registration flow to obtain a fresh token
  }
  throw e;
}

When it happens

Trigger: Calling GET /user-key-policies/settings as an unauthenticated guest with user_id=<uuid>&token=<uuid> where no authentication_tokens row exists with that token value, that user_id, and type=register — e.g. token belongs to another user or was deleted.

Common situations: Client copied a token from a different user's registration flow; token row cleaned up by expiry/cleanup tasks; stale token cached in browser extension or old setup link; registration already completed so the token was consumed.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• An authentication token should be provided.
• Attempt to access an expired verify token.
• Conflicting authentication parameters, provide…
• Could not import the user OpenPGP key.
• Could not import the user OpenPGP key.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/523ec22e6409344b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php:117

        }

        if (!Validation::uuid($userId)) {
            throw new BadRequestException(__('The user ID must be a valid UUID.'));
        }

        if (!Validation::uuid($authToken)) {
            throw new BadRequestException(__('The authentication token must be a valid UUID.'));
        }

        $errorMsg = __('Unable to authenticate the guest user with the provided credentials.');

        try {
            (new AuthenticationTokenGetService())
                ->getActiveNotExpiredOrFail($authToken, $userId, AuthenticationToken::TYPE_REGISTER);
        } catch (NotFoundException $exception) {
            $errorMsg .= ' ';
            $errorMsg .= __('No registration authentication token found for the given user.');
            throw new BadRequestException($errorMsg, null, $exception);
        } catch (CustomValidationException $exception) {
            $errorMsg .= ' ';
            $errorMsg .= __('The registration authentication token is expired.');
            throw new BadRequestException($errorMsg, null, $exception);
        } catch (Exception $exception) {
            throw new ForbiddenException($errorMsg, null, $exception); // phpcs:ignore
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)