{"record":{"id":"0c50c11048aa187a","repo":"passbolt/passbolt_api","slug":"resource-creation-modification-with-encrypted-metadata-not","errorCode":null,"errorMessage":"Resource creation/modification with encrypted metadata not allowed.","messagePattern":"Resource creation/modification with encrypted metadata not allowed\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php","lineNumber":85,"sourceCode":"     */\n    public function assertCreationAllowedByMetadataSettings(bool $isV5, string $entity): void\n    {\n        $v5Enabled = Configure::read('passbolt.v5.enabled');\n\n        if (!$v5Enabled && $isV5) {\n            throw new BadRequestException(__('V5 metadata format is not enabled.'));\n        }\n        if (!$v5Enabled) {\n            // No need to assert if format is v4 and v5 config is disabled\n            return;\n        }\n\n        $settingsDto = MetadataTypesSettingsGetService::getSettings();\n\n        if ($isV5) {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV5ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV5FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV5TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            }\n        } else {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV4ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV4FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php#L67-L103","documentation":"Passbolt throws this BadRequestException when a client attempts to create or update a resource using v5 (encrypted) metadata while the metadata types settings configured by the administrator disallow v5 resource creation. The check is performed by assertCreationAllowedByMetadataSettings (MetadataSettingsAwareTrait) against settings fetched via MetadataTypesSettingsGetService. It is a server-side policy enforcement, not a data corruption issue.","triggerScenarios":"POST/PUT to resource endpoints (or folder/tag flows) with v5 encrypted metadata while MetadataTypesSettingsDto::isV5ResourceCreationAllowed() returns false — i.e. assertV5ResourceCreationEnabled runs and the admin-disabled 'allow creation of v5 resources' flag is off.","commonSituations":"Admin disabled v5 (encrypted metadata) resource creation in metadata settings after clients already migrated; mobile/desktop/CLI clients defaulting to v5 metadata format; environments deliberately pinned to v4 cleartext metadata for compatibility (e.g. older clients or Pro/CE mixtures); after importing settings that only allow v4.","solutions":["Check the metadata types settings (GET /metadata/types/settings.json or the metadata_types_settings table) and confirm allowCreationOfV5Resources is disabled","Either switch the client to send v4 cleartext metadata, or have an admin re-enable v5 resource creation in the metadata settings (org settings UI or MetadataTypesSettingsChangeService)","Upgrade/patch the calling client so it respects the server's advertised allowed metadata types before attempting creation","If running a migration campaign, temporarily enable v5 creation, complete the migration, then disable it"],"exampleFix":"// before: client forces v5 metadata\n$resource = ['metadata_key_id' => $keyId, 'metadata' => $encrypted, 'resource_type_id' => $v5Type];\n// after: honor server settings, fall back to v4\nif (!$settings->isV5ResourceCreationAllowed()) {\n    $resource = ['name' => $cleartextName, 'resource_type_id' => $v4Type]; // no encrypted metadata\n}","handlingStrategy":"try-catch","validationCode":"// PHP client: check settings before creating\n$settings = $metadataTypesSettingsGetService->getSettings();\nif ($settings->isV5ResourceCreationAllowed()) { /* send v5 payload */ } else { /* send v4 or abort */ }","typeGuard":"function canCreateV5Resource(\\Passbolt\\Metadata\\Model\\Dto\\MetadataTypesSettingsDto $s): bool { return $s->isV5ResourceCreationAllowed(); }","tryCatchPattern":"try {\n    $resource = $resourcesService->create($data, $uac);\n} catch (\\Cake\\Http\\Exception\\BadRequestException $e) {\n    if ($e->getMessage() contains 'encrypted metadata not allowed') { /* fall back to v4 or surface admin-settings message */ }\n}","preventionTips":["Fetch and cache the server's metadata types settings at client startup","Gate all v5 metadata payloads behind the settings flags","Re-check settings after admin-driven config changes","Log which metadata version was used per request to ease diagnosis"],"tags":["passbolt","metadata","validation","api-policy"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}