How to fix MALFORMED_ID in Salesforce deployments

A value passed where Salesforce expects a record ID isn't a valid ID at all, not just the wrong one.

Surfaces during: runtime DML and SOQL, in data loads, integrations, and Apex tests

What it means

MALFORMED_ID means the value Salesforce received isn't a syntactically valid record ID: wrong length, invalid characters, or a value that isn't an ID at all. This differs from INVALID_ID_FIELD, where the ID is well-formed but points to the wrong record or object; MALFORMED_ID means the string itself is broken.

A valid Salesforce ID is always 15 or 18 alphanumeric characters starting with a three-character object key prefix; anything shorter, longer, or containing characters outside [A-Za-z0-9] fails this check before Salesforce ever attempts to resolve it to a record.

Diagnosis

Common causes

A blank or null value passed as an ID

Code or test data passes an empty string or null where a required ID field expects a real value.

CSV or data load truncated an ID

A data import file cut off characters during export, or a spreadsheet auto-formatted the ID column and corrupted the value.

A non-ID string assigned to an ID field

Test setup or a hardcoded constant assigns a name, label, or placeholder text to a variable typed as an Id.

The fix

Validate ID format before use
Check that any dynamically built or imported ID is exactly 15 or 18 alphanumeric characters before passing it into DML or a lookup.
```
Boolean looksLikeId = idValue != null
    && idValue.isAlphanumeric()
    && (idValue.length() == 15 || idValue.length() == 18);
```
Re-export data load files without reformatting
Export CSVs as plain text and disable spreadsheet auto-formatting that can strip or alter ID columns.
Never hardcode placeholder IDs in test setup
Query for a real record ID in test setup instead of assigning a literal string to an Id-typed variable.

In practice

How Serpent prevents this

Serpent AI resolves references by business key instead of raw ID strings when moving changes between environments, so a malformed or hardcoded ID never reaches a target org's deploy. See the Salesforce deployment error library.

Metadata and data in one deployment flow in Serpent

Prevention

Force ID-column formatting to plain text before every export

Set the ID column's format explicitly in spreadsheet tools before exporting to CSV, so auto-formatting never silently mangles the value.

Type ID-holding variables as Id, never String

Use the Apex Id type wherever a variable holds a record identifier, so an invalid assignment fails immediately instead of surfacing later as a runtime DML error.

Add a format check at every integration boundary

Validate ID shape at the point where external data enters Salesforce, an integration middleware step or a data-load transform, not only inside Apex.

Common questions

MALFORMED_ID, answered

How is MALFORMED_ID different from INVALID_ID_FIELD?

MALFORMED_ID means the value isn't a valid ID string at all. INVALID_ID_FIELD means the ID is well-formed but points to a record that doesn't exist or belongs to the wrong object.

Does Apex's Id.valid() method reliably catch this before DML?

Yes, for length and character-set checks. It confirms the string is shaped like a valid Salesforce ID, though it can't confirm the record actually exists, that's a separate check.

Can trailing whitespace alone cause MALFORMED_ID?

Yes. A copy-pasted ID with a trailing space or newline character fails the alphanumeric check, even though the visible ID characters themselves are correct.

Start free. No credit card, no install, no commitment.

Set up in under 15 minutes. No DevOps hire needed.

Start free Book a demo