Return 400 for search requests without identifiers

server/main.py

@@ -434,12 +434,19 @@ def search_memories(search_req: SearchRequest, _auth=Depends(verify_auth)):
                 ", ".join(deprecated_keys),
                 ", ".join(f'"{k}": "..."' for k in deprecated_keys),
             )
+        if not any(key in filters for key in ("user_id", "agent_id", "run_id")):
+            raise HTTPException(
+                status_code=400,
+                detail="filters must contain at least one of: user_id, agent_id, run_id",
+            )
         params = {}
         if search_req.top_k is not None:
             params["top_k"] = search_req.top_k
         if search_req.threshold is not None:
             params["threshold"] = search_req.threshold
         return get_memory_instance().search(query=search_req.query, filters=filters, **params)
+    except HTTPException:
+        raise
     except Exception:
         raise upstream_error()
 

tests/test_server_params.py

@@ -641,11 +641,11 @@ def test_entity_ids_merged_with_explicit_filters(self, client, mock_memory):
         assert kwargs["filters"]["user_id"] == "u1"
         assert kwargs["filters"]["category"] == "food"
 
-    def test_no_entity_ids_no_filters(self, client, mock_memory):
-        resp = client.post("/search", json={"query": "food"})
-        assert resp.status_code == 200
-        _, kwargs = mock_memory.search.call_args
-        assert kwargs["filters"] == {}
+    def test_missing_identifier_returns_400(self, client, mock_memory):
+        resp = client.post("/search", json={"query": "food", "filters": {}, "top_k": 5})
+        assert resp.status_code == 400
+        assert resp.json()["detail"] == "filters must contain at least one of: user_id, agent_id, run_id"
+        mock_memory.search.assert_not_called()
 
     def test_only_filters_no_entity_ids(self, client, mock_memory):
         resp = client.post("/search", json={