hyperledger/fabric · error

validation of key %s (coll'%s':ns'%s') in tx %d:%d failed

Error message

validation of key %s (coll'%s':ns'%s') in tx %d:%d failed

What it means

In validator_keylevel.go, checkSBAndCCEP evaluates the key-level validation parameter (state-based endorsement policy vp) against the endorsement signature set for the specific key (with its collection and namespace). Failure is wrapped in this error identifying the key, collection, namespace, block and tx, marking the transaction invalid.

Source

Thrown at core/common/validation/statebased/validator_keylevel.go:79

		//    best to err on the side of caution and rather halt processing (because a
		//    deterministic error is treated like an I/O one) rather than risking a fork
		//    (in case an I/O error is treated as a deterministic one).
		default:
			return &commonerrors.VSCCExecutionFailureError{
				Err: err,
			}
		}
	}

	// if no key-level validation parameter has been specified, the regular cc endorsement policy needs to hold
	if len(vp) == 0 {
		return p.CheckCCEPIfNotChecked(cc, coll, blockNum, txNum, signatureSet)
	}

	// validate against key-level vp
	err = p.policySupport.Evaluate(vp, signatureSet)
	if err != nil {
		return policyErr(errors.Wrapf(err, "validation of key %s (coll'%s':ns'%s') in tx %d:%d failed", key, coll, cc, blockNum, txNum))
	}

	p.SBEPChecked()

	return nil
}

func (p *baseEvaluator) Evaluate(blockNum, txNum uint64, NsRwSets []*rwsetutil.NsRwSet, ns string, sd []*protoutil.SignedData) commonerrors.TxValidationError {
	// iterate over all writes in the rwset
	for _, nsRWSet := range NsRwSets {
		// skip other namespaces
		if nsRWSet.NameSpace != ns {
			continue
		}

		// public writes
		// we validate writes against key-level validation parameters
		// if any are present or the chaincode-wide endorsement policy

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Read the key's current validation parameter (GetStateValidationParameter/GetPrivateDataValidationParameter) and collect endorsements satisfying it
2. Update or clear the key-level EP with SetStateValidationParameter if it is wrong, then re-submit
3. Ensure the chaincode's endorsing logic requests signatures from orgs required by the key-level policy
4. Inspect the key's metadata/ownership conventions in the chaincode to understand who set the VP

vp, err := stub.GetStateValidationParameter(key)
if err != nil { return err }
if len(vp) != 0 && !satisfies(vp, endorsementSignatures) {
	return fmt.Errorf("key %s requires endorsements per its key-level policy", key)
}

When it happens

Trigger: Evaluate → checkSBAndCCEP where a key has a key-level endorsement policy (set via SetStateValidationParameter) that the transaction's signature set fails to satisfy.

Common situations: Client writes a key whose key-level EP requires orgs that didn't endorse; application set a restrictive VP via SetPrivateDataValidationParameter/SetValidationParameter; VP set by another party (e.g. an audit org) is stricter than expected; chaincode writes keys in collections with per-key policies.

Related errors

• validation of endorsement policy for chaincode %s in tx %d:%
• validation of endorsement policy for collection %s chaincode
• validation of endorsement policy for chaincode %s in tx %d:%
• policy '%s' must be defined for channel '%s' before chaincod
• failed creating a comparable principal set for state based e

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/f67d802b941715b1. Report an issue: GitHub.