{"record":{"id":"7d563bfe1b09a031","repo":"passbolt/passbolt_api","slug":"the-metadata-private-key-could-not-be-validated","errorCode":null,"errorMessage":"The metadata private key could not be validated.","messagePattern":"The metadata private key could not be validated\\.","errorType":"validation","errorClass":"ValidationException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Service/MetadataPrivateKeysCreateService.php","lineNumber":106,"sourceCode":"\n        return $created;\n    }\n\n    /**\n     * Handle validation or build rules failure\n     *\n     * @param \\Passbolt\\Metadata\\Model\\Entity\\MetadataPrivateKey $entity that is failing the validation\n     * @param \\Passbolt\\Metadata\\Model\\Table\\MetadataPrivateKeysTable $table table\n     * @throws \\App\\Error\\Exception\\ValidationException\n     * @return void\n     */\n    protected function handleValidationErrors(MetadataPrivateKey $entity, MetadataPrivateKeysTable $table): void\n    {\n        if (Configure::read('debug')) {\n            Log::error(json_encode($entity->getErrors()));\n        }\n        $msg = __('The metadata private key could not be validated.');\n        throw new ValidationException($msg, $entity, $table);\n    }\n\n    /**\n     * @param \\App\\Utility\\UserAccessControl $uac user access control\n     * @param string $metadataKeyId key id\n     * @param array $data user provided data\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException If provided data is invalid.\n     * @throws \\Cake\\Http\\Exception\\NotFoundException If given metadata key is deleted or doesn't exist.\n     */\n    protected function assertRequestSanity(UserAccessControl $uac, string $metadataKeyId, array $data): void\n    {\n        $uac->assertIsAdmin();\n        if (!Validation::uuid($metadataKeyId)) {\n            throw new BadRequestException(__('The request data is invalid.'));\n        }\n        if (isset($data['user_id']) && !Validation::uuid($data['user_id'])) {\n            throw new BadRequestException(__('The request data is invalid.'));","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/MetadataPrivateKeysCreateService.php#L88-L124","documentation":"Thrown by MetadataPrivateKeysCreateService::handleValidationErrors when the MetadataPrivateKey entity fails table validation before save. It wraps a ValidationException carrying the entity and table, so callers receive the field-level errors; in debug mode the errors are also logged.","triggerScenarios":"create() is called with data that fails MetadataPrivateKeysTable rules — e.g. missing or invalid 'data' (OpenPGP packet), bad user_id, or server/user key payload not matching the table's validation rules.","commonSituations":"Client sending plaintext or malformed armored key data instead of a properly signed OpenPGP message; missing user_id for user-key shares; schema changes between server versions altering required fields.","solutions":["Read the errors array in the ValidationException response and fix the flagged fields","Ensure 'data' contains a valid, signed OpenPGP message armored key material","Ensure 'user_id' is a valid UUID of an existing user (or omit for the server key)","Regenerate the metadata private key payload with an up-to-date client matching the server's expected format"],"exampleFix":"// before\n{\"data\": \"-----BEGIN PGP MESSAGE-----\"} // truncated/invalid armor\n// after\n{\"user_id\": \"<valid-uuid>\", \"data\": \"<complete armored OpenPGP message>\"}","handlingStrategy":"validation","validationCode":"const ok = typeof data.data === 'string' && data.data.startsWith('-----BEGIN PGP MESSAGE-----') && (data.user_id === undefined || UUID_RE.test(data.user_id));","typeGuard":"function isValidPayload(d) { return typeof d?.data === 'string' && (d.user_id === undefined || UUID_RE.test(d.user_id)); }","tryCatchPattern":"catch (e) { if (e.response?.status === 422 && e.response?.body?.errors) { mapEntityErrors(e.response.body.errors); } throw e; }","preventionTips":["Validate armored OpenPGP output shape before sending","Always include complete armored messages, never truncated","Keep encryption client version in sync with server expectations"],"tags":["validation","http-422","metadata","openpgp"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}