{"record":{"id":"f1363bfcb2e4406e","repo":"passbolt/passbolt_api","slug":"the-request-data-is-invalid-metadataprivatekeysupdateservice","errorCode":null,"errorMessage":"The request data is invalid.","messagePattern":"The request data is invalid\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Service/MetadataPrivateKeysUpdateService.php","lineNumber":50,"sourceCode":"\nclass MetadataPrivateKeysUpdateService\n{\n    use LocatorAwareTrait;\n\n    /**\n     * @param \\App\\Utility\\UserAccessControl $uac user access control\n     * @param string $privateKeyId uuid\n     * @param array $data user provided data\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the data is invalid\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the record is not found or does not belong to the user\n     * @throws \\App\\Error\\Exception\\ValidationException if the data does not validate\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if data could not be saved because of an internal issue\n     * @return \\Passbolt\\Metadata\\Model\\Entity\\MetadataPrivateKey\n     */\n    public function update(UserAccessControl $uac, string $privateKeyId, array $data): MetadataPrivateKey\n    {\n        if (!isset($data['data']) || !is_string($data['data'])) {\n            throw new BadRequestException(__('The request data is invalid.'));\n        }\n        if (!Validation::uuid($privateKeyId)) {\n            throw new BadRequestException(__('The request data is invalid.'));\n        }\n\n        /** @var \\Passbolt\\Metadata\\Model\\Table\\MetadataPrivateKeysTable $metadataPrivateKeysTable */\n        $metadataPrivateKeysTable = $this->fetchTable('Passbolt/Metadata.MetadataPrivateKeys');\n        try {\n            /** @var \\Passbolt\\Metadata\\Model\\Entity\\MetadataPrivateKey $metadataPrivateKey */\n            $metadataPrivateKey = $metadataPrivateKeysTable\n                ->find()\n                ->where(['user_id' => $uac->getId(), 'id ' => $privateKeyId])\n                ->firstOrFail();\n        } catch (RecordNotFoundException $exception) {\n            throw new NotFoundException(__('The metadata private key does not exist or has been deleted.'));\n        }\n\n        if ($metadataPrivateKey->modified_by === $uac->getId()) {","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/MetadataPrivateKeysUpdateService.php#L32-L68","documentation":"BadRequestException thrown in MetadataPrivateKeysUpdateService::update when the request payload lacks a 'data' key or its value is not a string. The service validates input shape before touching the database. This guards against persisting malformed encrypted key payloads.","triggerScenarios":"PUT to the metadata private key endpoint with body missing `data`, or `data` present as an object/array/null/number instead of a string (e.g. sending parsed JSON of the encrypted payload rather than its string form).","commonSituations":"Client libraries auto-decoding base64/JSON payloads before sending; forgetting to JSON-serialize the encrypted blob; copy-pasting request examples that use object payloads.","solutions":["Ensure the request body contains a `data` key whose value is the encrypted payload as a plain string.","If your client builds the payload as an object, serialize it to a string before sending.","Log the outgoing request body and confirm `typeof data === 'string'` (or PHP is_string)."],"exampleFix":"// before\n{\"data\": {\"armored\": \"...\"}}\n// after\n{\"data\": \"{\\\"armored\\\": \\\"...\\\"}\"}","handlingStrategy":"type-guard","validationCode":"// JS\nfunction isStringData(payload) {\n  return payload != null && typeof payload.data === 'string' && payload.data.length > 0;\n}\n// PHP\nif (!isset($data['data']) || !is_string($data['data'])) { /* fix payload */ }","typeGuard":"function hasStringData(p) { return typeof p === 'object' && p !== null && typeof p.data === 'string'; }","tryCatchPattern":"catch (BadRequestException) { // 400\n  // inspect and fix the payload: data must be a string\n}","preventionTips":["Never auto-decode the encrypted payload before sending","Always send `data` as a string","Add a pre-send payload assertion in client tests"],"tags":["bad-request","validation","metadata","php"],"backgroundTag":"invalid-argument-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}