From 8a35b886eaf7c69c417b4dfd7a3093a15e992b98 Mon Sep 17 00:00:00 2001
From: Kian Jones <11655409+kianjones9@users.noreply.github.com>
Date: Fri, 17 Oct 2025 16:38:04 -0700
Subject: [PATCH] feat: add path parameter validation to message_id (#5515)

* feat: add path parameter validation to message_id

* fix: typo

* add comment for agent_id here

* openapi.json changes
---
 fern/openapi.json                          | 32 +++++++++++++++-------
 letta/server/rest_api/routers/v1/agents.py |  4 +--
 letta/server/rest_api/routers/v1/groups.py |  3 +-
 3 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/fern/openapi.json b/fern/openapi.json
index 32b70e4a..87e54792 100644
--- a/fern/openapi.json
+++ b/fern/openapi.json
@@ -6347,15 +6347,6 @@
         "description": "Update the details of a message associated with an agent.",
         "operationId": "modify_message",
         "parameters": [
-          {
-            "name": "message_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "title": "Message Id"
-            }
-          },
           {
             "name": "agent_id",
             "in": "path",
@@ -6370,6 +6361,21 @@
               "title": "Agent Id"
             },
             "description": "The ID of the agent in the format 'agent-<uuid4>'"
+          },
+          {
+            "name": "message_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 44,
+              "maxLength": 44,
+              "pattern": "^message-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$",
+              "description": "The ID of the message in the format 'message-<uuid4>'",
+              "examples": ["message-123e4567-e89b-42d3-8456-426614174000"],
+              "title": "Message Id"
+            },
+            "description": "The ID of the message in the format 'message-<uuid4>'"
           }
         ],
         "requestBody": {
@@ -7725,8 +7731,14 @@
             "required": true,
             "schema": {
               "type": "string",
+              "minLength": 44,
+              "maxLength": 44,
+              "pattern": "^message-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$",
+              "description": "The ID of the message in the format 'message-<uuid4>'",
+              "examples": ["message-123e4567-e89b-42d3-8456-426614174000"],
               "title": "Message Id"
-            }
+            },
+            "description": "The ID of the message in the format 'message-<uuid4>'"
           }
         ],
         "requestBody": {
diff --git a/letta/server/rest_api/routers/v1/agents.py b/letta/server/rest_api/routers/v1/agents.py
index f6417290..c7c6a7a5 100644
--- a/letta/server/rest_api/routers/v1/agents.py
+++ b/letta/server/rest_api/routers/v1/agents.py
@@ -1127,8 +1127,8 @@ async def list_messages(
 
 @router.patch("/{agent_id}/messages/{message_id}", response_model=LettaMessageUnion, operation_id="modify_message")
 async def modify_message(
-    message_id: str,
-    agent_id: str = PATH_VALIDATORS["agent"],
+    agent_id: str = PATH_VALIDATORS["agent"],  # backwards compatible. Consider removing for v1
+    message_id: str = PATH_VALIDATORS["message"],
     request: LettaMessageUpdateUnion = Body(...),
     server: "SyncServer" = Depends(get_letta_server),
     headers: HeaderParams = Depends(get_headers),
diff --git a/letta/server/rest_api/routers/v1/groups.py b/letta/server/rest_api/routers/v1/groups.py
index 8bcf1ca0..57ee3547 100644
--- a/letta/server/rest_api/routers/v1/groups.py
+++ b/letta/server/rest_api/routers/v1/groups.py
@@ -11,6 +11,7 @@ from letta.schemas.letta_request import LettaRequest, LettaStreamingRequest
 from letta.schemas.letta_response import LettaResponse
 from letta.server.rest_api.dependencies import HeaderParams, get_headers, get_letta_server
 from letta.server.server import SyncServer
+from letta.validators import PATH_VALIDATORS
 
 router = APIRouter(prefix="/groups", tags=["groups"])
 
@@ -203,7 +204,7 @@ GroupMessagesResponse = Annotated[
 @router.patch("/{group_id}/messages/{message_id}", response_model=LettaMessageUnion, operation_id="modify_group_message")
 async def modify_group_message(
     group_id: str,
-    message_id: str,
+    message_id: str = PATH_VALIDATORS["message"],
     request: LettaMessageUpdateUnion = Body(...),
     server: "SyncServer" = Depends(get_letta_server),
     headers: HeaderParams = Depends(get_headers),