[ENG-1978] validation errors from api v 1 privacy request prevent loading request manager UI

[JadeCara]

Ticket ENG-1978

Description Of Changes

🎯 In 2.74.0 we made a change to the response schema validation for /api/v1/privacy-request which is causing existing privacy requests to fail validation

There are many examples of privacy requests with identity values that are arrays (not strings). Here’s a (redacted) version of some error logs from their environment:

2025-11-13 17:43:32.545 | ERROR    |  - 13 validation errors:
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestVerboseResponse', 'identity', 'regi_id', 'str'), 'msg': 'Input should be a valid string', 'input': {'label': 'Regi ID', 'value': [12345678]}}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestVerboseResponse', 'identity', 'regi_id', 'IdentityValue', 'value'), 'msg': 'Input should be a valid string', 'input': [12345678]}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestVerboseResponse', 'identity', 'agent_id', 'str'), 'msg': 'Input should be a valid string', 'input': {'label': 'Agent ID', 'value': ['one', 'two', 'three']}}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestVerboseResponse', 'identity', 'agent_id', 'IdentityValue', 'value'), 'msg': 'Input should be a valid string', 'input': ['one', 'two', 'three']}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestVerboseResponse', 'identity', 'user_id', 'str'), 'msg': 'Input should be a valid string', 'input': {'label': 'User ID', 'value': [12345678, 'one', 'two', 'three']}}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestVerboseResponse', 'identity', 'user_id', 'IdentityValue', 'value'), 'msg': 'Input should be a valid string', 'input': [12345678, 'one', 'two', 'three']}
  {'type': 'dict_type', 'loc': ('response', 'items', 0, 'PrivacyRequestVerboseResponse', 'execution_and_audit_logs_by_dataset'), 'msg': 'Input should be a valid dictionary', 'input': None}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestResponse', 'identity', 'regi_id', 'str'), 'msg': 'Input should be a valid string', 'input': {'label': 'Regi ID', 'value': [12345678]}}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestResponse', 'identity', 'regi_id', 'IdentityValue', 'value'), 'msg': 'Input should be a valid string', 'input': [12345678]}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestResponse', 'identity', 'agent_id', 'str'), 'msg': 'Input should be a valid string', 'input': {'label': 'Agent ID', 'value': ['one', 'two', 'three']}}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestResponse', 'identity', 'agent_id', 'IdentityValue', 'value'), 'msg': 'Input should be a valid string', 'input': ['one', 'two', 'three']}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestResponse', 'identity', 'user_id', 'str'), 'msg': 'Input should be a valid string', 'input': {'label': 'User ID', 'value': [12345678, 'one', 'two', 'three']}}
  {'type': 'string_type', 'loc': ('response', 'items', 0, 'PrivacyRequestResponse', 'identity', 'user_id', 'IdentityValue', 'value'), 'msg': 'Input should be a valid string', 'input': [12345678, 'one', 'two', 'three']}

Implementation Details

This appears to be a regression introduced by this change in 2.74.0: https://github.com/ethyca/fides/pull/6894/files#diff-b58da0c021b7b385689d8383e10ab6dfe233f7e50dfe4195eaaab8a2af0b4bd2R338

Code Changes

• Fixed the identity schema to use MultiValue instead of str
• Added tests that would have caught the regression.

Steps to Confirm

1. Create a DSR with a spicy custom identity.
2. Verify that there are no pydantic issues.

Pre-Merge Checklist

• Issue requirements met
• All CI pipelines succeeded
• CHANGELOG.md updated
  • Add a db-migration This indicates that a change includes a database migration label to the entry if your change includes a DB migration
  • Add a high-risk This issue suggests changes that have a high-probability of breaking existing code label to the entry if your change includes a high-risk change (i.e. potential for performance impact or unexpected regression) that should be flagged
  • Updates unreleased work already in Changelog, no new entry necessary
• UX feedback:
  • All UX related changes have been reviewed by a designer
  • No UX review needed
• Followup issues:
  • Followup issues created
  • No followup issues
• Database migrations:
  • Ensure that your downrev is up to date with the latest revision on main
  • Ensure that your downgrade() migration is correct and works
    • If a downgrade migration is not possible for this change, please call this out in the PR description!
  • No migrations
• Documentation:
  • Documentation complete, PR opened in fidesdocs
  • Documentation issue created in fidesdocs
  • If there are any new client scopes created as part of the pull request, remember to update public-facing documentation that references our scope registry
  • No documentation updates required

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
fides-plus-nightly	Ignored	Preview		Nov 13, 2025 8:26pm
fides-privacy-center	Ignored			Nov 13, 2025 8:26pm

[greptile-apps]

Greptile Overview

Greptile Summary

Fixes a regression introduced in 2.74.0 where IdentityValue.value was changed from accepting any type to only accepting strings, causing validation errors for existing privacy requests with list-type identity values.

Key Changes:

• Changed IdentityValue.value from Optional[str] to Optional[MultiValue] to accept int, str, or lists of int/str
• Made execution_and_audit_logs_by_dataset Optional with default=None to handle the verbose=False case where the property is set to None
• Added comprehensive parametrized tests with 9 test cases covering all MultiValue type combinations that would have caught this regression

Impact:
This fix resolves the critical issue preventing Request Manager UI from loading when privacy requests contain array identity values.

Confidence Score: 5/5

• This PR is safe to merge with no risk
• The changes are well-targeted and fix a critical regression. The schema change correctly aligns IdentityValue.value with the MultiValue type used by LabeledIdentity, and the comprehensive test coverage (9 parametrized test cases) validates all possible value types. The fix for execution_and_audit_logs_by_dataset addresses the previous review comment correctly by making it Optional with default=None.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
src/fides/api/schemas/privacy_request.py	5/5	Fixed IdentityValue.value to accept MultiValue (int, str, or lists), and made execution_and_audit_logs_by_dataset Optional with default=None to handle verbose=False case
tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_endpoints.py	5/5	Added comprehensive parametrized test covering all MultiValue types (int, str, lists) to prevent regression of identity validation errors

[greptile-apps]

_{3 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[JadeCara]

@greptile please review

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.32%. Comparing base (75f2671) to head (0795630).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6964   +/-   ##
=======================================
  Coverage   87.32%   87.32%           
=======================================
  Files         525      525           
  Lines       34427    34427           
  Branches     3962     3962           
=======================================
  Hits        30062    30062           
  Misses       3501     3501           
  Partials      864      864           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.