{"record":{"id":"4b349cb7b21a3882","repo":"hyperledger/fabric","slug":"validation-of-endorsement-policy-for-collection-s","errorCode":null,"errorMessage":"validation of endorsement policy for collection %s chaincode %s in tx %d:%d failed","messagePattern":"validation of endorsement policy for collection (.+?) chaincode (.+?) in tx (.+?):(.+?) failed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/validation/statebased/v20.go","lineNumber":123,"sourceCode":"func (p *policyCheckerV20) CheckCCEPIfNotChecked(cc, coll string, blockNum, txNum uint64, sd []*protoutil.SignedData) commonerrors.TxValidationError {\n\tif coll != \"\" {\n\t\t// at first we check whether we have already evaluated an endorsement\n\t\t// policy for this collection\n\t\tif p.nsEPChecked[coll] {\n\t\t\treturn nil\n\t\t}\n\n\t\t// if not, we fetch the collection endorsement policy\n\t\tcollEP, err := p.fetchCollEP(cc, coll)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t// if there is an endorsement policy for the collection, we evaluate it\n\t\tif len(collEP) != 0 {\n\t\t\terr := p.policySupport.Evaluate(collEP, sd)\n\t\t\tif err != nil {\n\t\t\t\treturn policyErr(errors.Wrapf(err, \"validation of endorsement policy for collection %s chaincode %s in tx %d:%d failed\", coll, cc, blockNum, txNum))\n\t\t\t}\n\n\t\t\tp.nsEPChecked[coll] = true\n\t\t\tp.someEPChecked = true\n\t\t\treturn nil\n\t\t}\n\t}\n\n\t// we're here either because we're not in a collection or because there was\n\t// no endorsement policy for that collection - we turn to the chaincode EP\n\tif p.nsEPChecked[\"\"] {\n\t\treturn nil\n\t}\n\n\t// evaluate the cc EP\n\terr := p.policySupport.Evaluate(p.ccEP, sd)\n\tif err != nil {\n\t\treturn policyErr(errors.Wrapf(err, \"validation of endorsement policy for chaincode %s in tx %d:%d failed\", cc, blockNum, txNum))","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/validation/statebased/v20.go#L105-L141","documentation":"The v2.0 state-based validator's CheckCCEPIfNotChecked, when a collection-specific endorsement policy (collEP) exists, evaluates it against the transaction's signature set. Failure is wrapped in this error naming the collection, chaincode, block and tx, marking the transaction invalid.","triggerScenarios":"Validating a rwset entry for a private data collection whose collection-level endorsement policy (set via key-level endorsement or collection config) is not satisfied by the transaction's endorsements.","commonSituations":"Private data collections with EP requiring an org that did not sign; collection endorsement policy changed (SetCollectionEP) after endorsement; client unaware a key resides in a collection with stricter endorsement requirements.","solutions":["Collect endorsements satisfying the collection's endorsement policy (query its config via qscc/_collections)","Re-run endorsement after any SetCollectionEP/policy change","Ensure all orgs named in the collection EP have peers and their signatures are included","Verify key-level endorsement metadata for the collection is what you expect via GetPrivateDataValidationParameter"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"collEP, _ := validator.GetPrivateDataValidationParameter(cc, coll, key)\nif len(collEP) != 0 && !satisfies(collEP, signatureSet) { return errors.New(\"collection EP not satisfied\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check collection endorsement policy config before writing private data keys","Update client endorsement collection logic after SetCollectionEP changes","Verify which collections each key belongs to (hash-based mapping)"],"tags":["fabric","endorsement-policy","private-data","state-based-validation"],"backgroundTag":"endorsement-policy-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}