srbhr/Resume-Matcher · error · HTTPException

Confirmation required. Pass confirm=RESET_ALL_DATA in reques

Error message

Confirmation required. Pass confirm=RESET_ALL_DATA in request body.

What it means

Raised by the reset_database_endpoint in apps/backend/app/routers/config.py as a destructive-action safeguard. The endpoint wipes the database only when the request body explicitly carries confirm="RESET_ALL_DATA"; anything else gets a 400 before db.reset_database() runs.

Source

Thrown at apps/backend/app/routers/config.py:669

    WARNING: This action is irreversible. It will:
    1. Truncate all database tables (resumes, jobs, improvements)
    2. Delete all uploaded files

    Requires confirmation token for safety.

    Args:
        request: Request body containing confirmation token

    Returns:
        Success message

    Note:
        This is a local-only endpoint for single-user deployments.
        In production/multi-user scenarios, add proper authentication.
    """
    if request.confirm != "RESET_ALL_DATA":
        raise HTTPException(
            status_code=400,
            detail="Confirmation required. Pass confirm=RESET_ALL_DATA in request body.",
        )
    await db.reset_database()
    return {"message": "Database and all data have been reset successfully"}

View on GitHub (pinned to 116f9cc3b0)

Solutions

Send a JSON body of {"confirm": "RESET_ALL_DATA"} exactly, case-sensitive
Verify the request Content-Type is application/json and the body is parsed into the request model
Confirm the client model field is named confirm and typed as a string
Back up data first — a confirmed call irreversibly resets the database

Example fix

// before
POST /config/reset-database  {}
// after
POST /config/reset-database  {"confirm": "RESET_ALL_DATA"}

Defensive patterns

Strategy: validation

Validate before calling

if (body?.confirm !== 'RESET_ALL_DATA') throw new Error('Reset requires confirm=RESET_ALL_DATA');

Try / catch

try { await api.resetDatabase({confirm:'RESET_ALL_DATA'}); } catch (e) { if (e.status === 400) console.error('Confirmation string missing/incorrect'); else throw e; }

Prevention

Copy the exact sentinel string from the API docs; it is case-sensitive
Back up the DB before any reset call
Gate the reset button behind a typed confirmation in the UI
Never construct the body dynamically from user free-text

When it happens

Trigger: POSTing to the database reset endpoint with a missing, misspelled, or wrong confirm field (e.g. confirm=true, confirm="reset", or omitting the body entirely).

Common situations: Client UI not sending the exact sentinel string; testing the endpoint with an empty body; calling it via curl/Postman without the JSON body; API clients assuming a simple confirmation flag.

Related errors

AI-assisted analysis of srbhr/Resume-Matcher@116f9cc3b0 (2026-08-28). Data as JSON: /api/errors/6bcda8579b340d51. Report an issue: GitHub.