nextcloud/all-in-one · error · \Exception

Unexpected response from deSEC during account registration (

Error message

Unexpected response from deSEC during account registration (HTTP {code}): {body}

What it means

Thrown by DesecManager::registerAccount after POSTing {email, password} to the deSEC /auth/ endpoint when the HTTP status is anything other than 202 Accepted. deSEC signals a queued registration with 202 (identically for brand-new and already-registered emails, to prevent enumeration); any other code means the request was rejected, rate-limited, or errored server-side, and the raw response body is embedded in the message for diagnosis.

Source

Thrown at php/src/Desec/DesecManager.php:206

     * (without sending a mail), so a 202 cannot be treated as proof of a new account.
     * The captcha field is omitted; deSEC requires it only at email-verification time,
     * which the user completes in the browser via the emailed link.
     *
     * @throws \Exception on network failure or an unexpected HTTP response
     */
    public function registerAccount(string $email, string $password): void {
        try {
            $res = $this->guzzleClient->post($this->configurationManager->desecApiBase . '/auth/', [
                'json' => ['email' => $email, 'password' => $password],
            ]);
        } catch (TransferException $e) {
            throw new \Exception('Could not reach the deSEC API: ' . $e->getMessage());
        }

        $code = $res->getStatusCode();

        if ($code !== 202) {
            throw new \Exception('Unexpected response from deSEC during account registration (HTTP ' . $code . '): ' . $res->getBody()->getContents());
        }
    }

    /**
     * Attempts to log in after the user was asked to verify a freshly created account.
     *
     * A login failure here has two common causes that we cannot tell apart, because
     * deSEC returns 202 both for a genuinely new account and for one whose email was
     * already registered (to prevent email enumeration):
     *   1. The account is new but its email has not been verified yet.
     *   2. The email already belonged to an existing deSEC account, so no new account
     *      (and no verification mail) was created and our generated password is wrong.
     * The message covers both and points to the fix for each.
     *
     * @throws \Exception with a friendly hint when login is not yet possible
     */
    private function loginAfterVerification(string $email, string $password): string {
        try {

View on GitHub (pinned to 6b788eec5e)

Solutions

1. Read the embedded response body in the exception message — deSEC states the exact rejection reason there
2. Verify the email is syntactically valid and reachable, and the password meets deSEC's policy
3. On HTTP 429, back off and retry registration later instead of retrying immediately
4. Confirm desecApiBase resolves to https://desec.io/api/v1
5. On 5xx, check desec.io status pages and retry once the service recovers

$email = trim($email);
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    throw new \InvalidArgumentException('Invalid email address.');
}
if (strlen($password) < 10) {
    throw new \InvalidArgumentException('Password too weak for deSEC (min 10 chars).');
}

try {
    $manager->registerAccount($email, $password);
} catch (\Exception $e) {
    if (str_starts_with($e->getMessage(), 'Unexpected response from deSEC during account registration')) {
        // $e->getMessage() contains HTTP code + raw body; surface body to the user verbatim
    }
    throw $e;
}

When it happens

Trigger: POST {desecApiBase}/auth/ returns 400 (invalid email syntax or password below deSEC's strength policy), 429 (registration rate limit), 401/403, or 5xx; or a misconfigured desecApiBase whose /auth/ route answers with a different status.

Common situations: Typo'd or syntactically invalid email; generated password failing deSEC's policy; automated tests hammering registration and tripping 429; a desec.io outage or API change; ConfigurationManager desecApiBase pointing at the wrong base URL.

Related errors

• A domain is already configured. Reset the AIO instance first
• Please provide a valid email address.
• The desired subdomain must contain only lowercase letters, d
• Could not reach the deSEC API: {message}
• Unexpected response from deSEC during login (HTTP {code}): {

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/f3b43112f2ef041d. Report an issue: GitHub.