{"record":{"id":"d714166601b6303b","repo":"passbolt/passbolt_api","slug":"tag-creation-modification-with-encrypted-metadata-not","errorCode":null,"errorMessage":"Tag creation/modification with encrypted metadata not allowed.","messagePattern":"Tag creation/modification with encrypted metadata not allowed\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php","lineNumber":93,"sourceCode":"        if (!$v5Enabled) {\n            // No need to assert if format is v4 and v5 config is disabled\n            return;\n        }\n\n        $settingsDto = MetadataTypesSettingsGetService::getSettings();\n\n        if ($isV5) {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV5ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV5FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV5TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore\n                }\n            }\n        } else {\n            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {\n                if (!$settingsDto->isV4ResourceCreationAllowed()) {\n                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {\n                if (!$settingsDto->isV4FolderCreationAllowed()) {\n                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));\n                }\n            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {\n                if (!$settingsDto->isV4TagCreationAllowed()) {\n                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));\n                }\n            }\n        }\n    }","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php#L75-L111","documentation":"Thrown when a tag is created or modified with v5 encrypted metadata while the metadata settings disallow v5 tag creation. The trait's assertCreationAllowedByMetadataSettings ENTITY_TAG branch raises BadRequestException via assertV5TagCreationEnabled (or assertV4TagCreationEnabled checking the opposite side).","triggerScenarios":"POST /tags, tag update, or resource-with-tags creation carrying encrypted is_shared/shared metadata (v5 format) while isV5TagCreationAllowed() returns false.","commonSituations":"Admin disabled v5 tags in metadata types settings; CLI/scripts tagging resources with v5 payloads; mixed client fleets where some clients adopted v5 metadata before the admin locked settings down.","solutions":["Check the metadata types settings for the v5 tag creation flag","Submit tags with v4 cleartext slug format instead of encrypted metadata","Have an admin enable 'allow creation of v5 tags' if encrypted tags are intended","Update client tooling to negotiate metadata version per server settings"],"exampleFix":"// before\n$tag = ['slug' => $encryptedSlug, 'is_shared' => $encBool]; // v5\n// after\n$tag = ['slug' => 'production']; // v4 cleartext","handlingStrategy":"validation","validationCode":"// verify tag payload version before sending\n$isV5 = isset($tag['is_shared']) || isset($tag['metadata_key_id']);\nif ($isV5 && !$settings->isV5TagCreationAllowed()) { /* convert to plain slug */ }","typeGuard":null,"tryCatchPattern":"try { $tag = $tagsService->create($data, $uac); }\ncatch (\\Cake\\Http\\Exception\\BadRequestException $e) { /* downgrade to v4 slug or abort with clear message */ }","preventionTips":["Only use encrypted tag payloads when server settings allow v5 tags","Default to v4 slugs in scripts unless v5 is explicitly enabled","Add an integration test per entity type (resource/folder/tag) x metadata version"],"tags":["passbolt","metadata","tags","api-policy"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}