{"record":{"id":"3931ee110f97e85e","repo":"phacility/phabricator","slug":"this-transaction-group-requires-mfa-to-apply-but","errorCode":null,"errorMessage":"This transaction group requires MFA to apply, but you can not provide an MFA response via Conduit. Edit this object via the web UI.","messagePattern":"This transaction group requires MFA to apply, but you can not provide an MFA response via Conduit\\. Edit this object via the web UI\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php","lineNumber":5480,"sourceCode":"    $object_phid = $object->getPHID();\n    if ($object_phid) {\n      $workflow_key = sprintf(\n        'editor(%s).phid(%s)',\n        $editor_class,\n        $object_phid);\n    } else {\n      $workflow_key = sprintf(\n        'editor(%s).new()',\n        $editor_class);\n    }\n\n    $request = $this->getRequest();\n    if ($request === null) {\n      $source_type = $this->getContentSource()->getSourceTypeConstant();\n      $conduit_type = PhabricatorConduitContentSource::SOURCECONST;\n      $is_conduit = ($source_type === $conduit_type);\n      if ($is_conduit) {\n        throw new Exception(\n          pht(\n            'This transaction group requires MFA to apply, but you can not '.\n            'provide an MFA response via Conduit. Edit this object via the '.\n            'web UI.'));\n      } else {\n        throw new Exception(\n          pht(\n            'This transaction group requires MFA to apply, but the Editor was '.\n            'not configured with a Request. This workflow can not perform an '.\n            'MFA check.'));\n      }\n    }\n\n    $cancel_uri = $this->getCancelURI();\n    if ($cancel_uri === null) {\n      throw new Exception(\n        pht(\n          'This transaction group requires MFA to apply, but the Editor was '.","sourceCodeStart":5462,"sourceCodeEnd":5498,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php#L5462-L5498","documentation":"When a transaction group has MFA requirements (e.g. an MFA-signed transaction type), the editor needs a live request to run the high-security workflow. If no request is configured and the content source is Conduit, Phabricator refuses because MFA challenges cannot be answered through Conduit; with any other source it reports that the editor lacks a Request.","triggerScenarios":"Applying MFA-requiring transactions through a Conduit method (maniphest.edit, differential.revision.edit, ...), or calling applyTransactions() from a daemon/script on an editor built with setActor()+setContentSource() but no setRequest().","commonSituations":"Bots automating edits that policy flags as requiring MFA; one-off bin/ scripts or scheduled daemons performing sign-worthy actions; developers testing editors from CLI without simulating a request.","solutions":["Perform the MFA-requiring edit from the web UI, which has a request and can issue the challenge.","For code-driven editors inside controllers, pass the request: $editor->setRequest($request) before applyTransactions().","Remove or replace the MFA-signing transaction type in automated workflows so the group no longer requires MFA.","In scripts that must run headless, configure the editor so it does not include REQUIRE_MFA transaction types."],"exampleFix":"// before\nid(new ManiphestTransactionEditor())\n  ->setActor($viewer)\n  ->setContentSource($source)\n  ->applyTransactions($task, $xactions); // contains MFA xaction\n\n// after\nid(new ManiphestTransactionEditor())\n  ->setActor($viewer)\n  ->setContentSource($source)\n  ->setRequest($request) // from the controller handling the edit\n  ->applyTransactions($task, $xactions);","handlingStrategy":"validation","validationCode":"// In headless workflows, refuse MFA groups before applying\n$source_type = $source->getSourceTypeConstant();\nif ($requires_mfa && $source_type === PhabricatorConduitContentSource::SOURCECONST) {\n  // route the caller to the web UI instead of failing mid-apply\n  throw new Exception(pht('This edit must be performed via the web UI.'));\n}\n// In controllers, always provide the request:\n$editor->setRequest($request);","typeGuard":null,"tryCatchPattern":"try {\n  $editor->applyTransactions($object, $xactions);\n} catch (Exception $ex) {\n  if (strpos($ex->getMessage(), 'requires MFA') !== false) {\n    // Tell the user to redo the action in the web UI\n    return $this->newDialog()->appendChild($ex->getMessage());\n  }\n  throw $ex;\n}","preventionTips":["Always pass the live request to editors used inside controllers (setRequest).","Keep MFA-signing transaction types out of daemon/script/bot workflows.","Document for API users which endpoints can trigger MFA so they use the web UI for those actions."],"tags":["phabricator","mfa","conduit","transactions","security"],"backgroundTag":"mfa-required","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}