{"record":{"id":"7d9fb873ad6415cb","repo":"passbolt/passbolt_api","slug":"secret-revisions-settings-endpoints-are-disabled","errorCode":null,"errorMessage":"Secret revisions settings endpoints are disabled.","messagePattern":"Secret revisions settings endpoints are disabled\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/SecretRevisions/src/Middleware/SecretRevisionsSettingsMiddleware.php","lineNumber":41,"sourceCode":"use Psr\\Http\\Server\\MiddlewareInterface;\nuse Psr\\Http\\Server\\RequestHandlerInterface;\n\nclass SecretRevisionsSettingsMiddleware implements MiddlewareInterface\n{\n    public const PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED =\n        'passbolt.security.secretRevisions.settings.editionDisabled';\n\n    /**\n     * @param \\Psr\\Http\\Message\\ServerRequestInterface $request The request.\n     * @param \\Psr\\Http\\Server\\RequestHandlerInterface $handler The handler.\n     * @return \\Psr\\Http\\Message\\ResponseInterface The response.\n     */\n    public function process(\n        ServerRequestInterface $request,\n        RequestHandlerInterface $handler\n    ): ResponseInterface {\n        if (Configure::read(self::PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED)) {\n            throw new ForbiddenException(__('Secret revisions settings endpoints are disabled.'));\n        }\n\n        return $handler->handle($request);\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":47,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/SecretRevisions/src/Middleware/SecretRevisionsSettingsMiddleware.php#L23-L47","documentation":"Thrown by SecretRevisionsSettingsMiddleware::process() when the Configure flag PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED is true; all secret-revisions settings endpoints are blocked with ForbiddenException (HTTP 403). This is an intentional security-setting gate, not a bug.","triggerScenarios":"Any request to secret revisions settings endpoints while the security config key passbolt.security.secretRevisionsSettingsEditionDisabled is set (typically via environment variable PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED=true).","commonSituations":"Self-hosted installs where the admin disabled secret-revisions settings endpoints for security hardening; environment variable accidentally set in one deployment; docs/proxies duplicating the flag across environments; tests verifying the endpoint is disabled.","solutions":["Remove or set to false the PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED environment variable and restart","Check config/passbolt.default.php and your environment for the security.secretRevisionsSettingsEditionDisabled key","If the endpoint should stay disabled, use the admin UI/CLI path intended for your deployment instead of the API"],"exampleFix":"# before\nPASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED=true\n# after\nPASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED=false","handlingStrategy":"try-catch","validationCode":"if (config.get('passbolt.security.secretRevisionsSettingsEditionDisabled')) {\n  // skip calling settings endpoints entirely\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.getSecretRevisionsSettings();\n} catch (e) {\n  if (e.status === 403) { /* feature disabled on server — hide the settings UI */ }\n  throw e;\n}","preventionTips":["Check the deployment's PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED env var before integrating","Provision consistent env vars across environments","Hide dependent UI features when the server reports 403 on settings endpoints"],"tags":["forbidden","config","middleware"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}