Infisical cannot read projectId from request payload

[aabmets]

Describe the bug

When making a POST request to /api/v4/secrets/<secret-name> with the required payload, Infisical sometimes returns error 400 with message Missing project data key, which doesn't make sense, since the projectId key is provided within the data payload.

My wild guess is that Infisical is unable to handle even a short programmatic simultaneous burst of 30 POST requests at /api/v4/secrets. I am using the single secret create endpoint, because the bulk create endpoint does not allow to set individual folders to each secret in the bulk request, but rather expects all secrets in the bulk request to be created into the same folder.

It only errors on few requests and it creates the majority of secrets just fine.
Here's the output from the logger script I created:

{
  "Request": {
    "Path": "/api/v4/secrets/APP_PGR__DATABASE",
    "Method": "POST",
    "Headers": {
      "Content-Type": "application/json",
      "Authorization": "Bearer <token>"
    },
    "Data": {
      "projectId": "c170d7a2-d6ec-459f-b85a-05be278fae25",
      "environment": "dev",
      "type": "shared",
      "secretValue": "myapp",
      "secretComment": "",
      "secretReminderNote": null,
      "secretReminderRepeatDays": null,
      "skipMultilineEncoding": false,
      "secretPath": "/Postgres-Read",
      "secretMetadata": []
    }
  },
  "Response": {
    "reqId": "req-8Gey9KdikY5tat",
    "statusCode": 400,
    "message": "Missing project data key",
    "error": "BadRequest"
  }
}

To Reproduce

Steps to reproduce the behavior:

1. Create a script to pound /api/v4/secrets with POST requests using await Promise.all()
2. Observe how some requests receive the error.

Expected behavior

Infisical should successfully read the full payload of each POST request.

Platform you are having the issue on:

self-hosted on docker compose stack

Additional info

This error is happening against Infisical version v0.150.0-nightly-20251001.