{"record":{"id":"f67d802b941715b1","repo":"hyperledger/fabric","slug":"validation-of-key-s-coll-s-ns-s-in-tx-d-d","errorCode":null,"errorMessage":"validation of key %s (coll'%s':ns'%s') in tx %d:%d failed","messagePattern":"validation of key (.+?) \\(coll'(.+?)':ns'(.+?)'\\) in tx (.+?):(.+?) failed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/validation/statebased/validator_keylevel.go","lineNumber":79,"sourceCode":"\t\t//    best to err on the side of caution and rather halt processing (because a\n\t\t//    deterministic error is treated like an I/O one) rather than risking a fork\n\t\t//    (in case an I/O error is treated as a deterministic one).\n\t\tdefault:\n\t\t\treturn &commonerrors.VSCCExecutionFailureError{\n\t\t\t\tErr: err,\n\t\t\t}\n\t\t}\n\t}\n\n\t// if no key-level validation parameter has been specified, the regular cc endorsement policy needs to hold\n\tif len(vp) == 0 {\n\t\treturn p.CheckCCEPIfNotChecked(cc, coll, blockNum, txNum, signatureSet)\n\t}\n\n\t// validate against key-level vp\n\terr = p.policySupport.Evaluate(vp, signatureSet)\n\tif err != nil {\n\t\treturn policyErr(errors.Wrapf(err, \"validation of key %s (coll'%s':ns'%s') in tx %d:%d failed\", key, coll, cc, blockNum, txNum))\n\t}\n\n\tp.SBEPChecked()\n\n\treturn nil\n}\n\nfunc (p *baseEvaluator) Evaluate(blockNum, txNum uint64, NsRwSets []*rwsetutil.NsRwSet, ns string, sd []*protoutil.SignedData) commonerrors.TxValidationError {\n\t// iterate over all writes in the rwset\n\tfor _, nsRWSet := range NsRwSets {\n\t\t// skip other namespaces\n\t\tif nsRWSet.NameSpace != ns {\n\t\t\tcontinue\n\t\t}\n\n\t\t// public writes\n\t\t// we validate writes against key-level validation parameters\n\t\t// if any are present or the chaincode-wide endorsement policy","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/validation/statebased/validator_keylevel.go#L61-L97","documentation":"In validator_keylevel.go, checkSBAndCCEP evaluates the key-level validation parameter (state-based endorsement policy vp) against the endorsement signature set for the specific key (with its collection and namespace). Failure is wrapped in this error identifying the key, collection, namespace, block and tx, marking the transaction invalid.","triggerScenarios":"Evaluate → checkSBAndCCEP where a key has a key-level endorsement policy (set via SetStateValidationParameter) that the transaction's signature set fails to satisfy.","commonSituations":"Client writes a key whose key-level EP requires orgs that didn't endorse; application set a restrictive VP via SetPrivateDataValidationParameter/SetValidationParameter; VP set by another party (e.g. an audit org) is stricter than expected; chaincode writes keys in collections with per-key policies.","solutions":["Read the key's current validation parameter (GetStateValidationParameter/GetPrivateDataValidationParameter) and collect endorsements satisfying it","Update or clear the key-level EP with SetStateValidationParameter if it is wrong, then re-submit","Ensure the chaincode's endorsing logic requests signatures from orgs required by the key-level policy","Inspect the key's metadata/ownership conventions in the chaincode to understand who set the VP"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"vp, err := stub.GetStateValidationParameter(key)\nif err != nil { return err }\nif len(vp) != 0 && !satisfies(vp, endorsementSignatures) {\n\treturn fmt.Errorf(\"key %s requires endorsements per its key-level policy\", key)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Before writing a key, read its validation parameter and satisfy it in the same tx","Document/standardize who may set key-level EPs via SetStateValidationParameter","Test key-level policies in a dev network with all required orgs present"],"tags":["fabric","key-level-endorsement","state-based-validation","endorsement-policy"],"backgroundTag":"endorsement-policy-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}