passbolt/passbolt_api · error · CustomValidationException

400

400

Error message

The tag metadata key data could not be updated.

What it means

Thrown by MetadataRotateKeyTagsUpdateService::updateData after nulling the V4 metadata props on a tag entity; if the entity carries validation errors at that point, a CustomValidationException (400) is raised listing the per-tag errors. It guards that the cleared V4 fields produced a consistent V5-only entity before saveMany is attempted.

Solutions

1. Inspect the $errors payload in the response (index -> field errors) to see which tag and field failed.
2. Verify the target metadata key exists, is not expired/revoked, and the entity's metadata_key_type matches the openpgp algorithm configured.
3. Re-encrypt the tag metadata with the new key and retry the rotation for the failing tags.
4. Fix any tag rows with leftover V4/V5 mixed data before rotating keys.

Example fix

// before
// retrying rotation with expired key
// after
// openpgp key that is valid & shared with the server:
// bin/cake passbolt metadata generate-key && share with users, then retry rotation

// before rotation, verify key usable
if (!metadataKeyExists(fingerprint) || metadataKeyIsExpired(fingerprint)) { abort(); }

try { rotateKey(tags) } catch (CustomValidationException $e) { logErrors($e->getErrors()); }

When it happens

Trigger: Rotating a metadata key for tags when, after setting each V4 meta prop to null, the entity has validation errors — typically invalid/missing metadata_key, metadata_key_type, or invalid encrypted metadata generated for the new key.

Common situations: Metadata key rotation where the new key is missing, expired, or the user/org has no access to it; gpg-encrypted metadata produced with a wrong key type; tags corrupted by prior partial migrations.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• 400
• The tag id is not valid.
• The tag metadata key data could not be updated.
• The tag metadata key data could not be updated.
• group(s) returned by your directory are invalid and will be…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/52c49538c7b49b6e. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Tags/src/Service/RotateKey/MetadataRotateKeyTagsUpdateService.php:72

        foreach ($data as $i => $values) {
            $tag = $entitiesToUpdate[$values['id']];

            $entity = $tagsTable->patchEntity($tag, $values, [
                'accessibleFields' => [
                    'name' => true,
                    'metadata_key_id' => true,
                    'metadata_key_type' => true,
                    'metadata' => true,
                ],
                'validate' => 'v5',
            ]);
            foreach (MetadataTagDto::V4_META_PROPS as $prop) {
                $entity->set($prop, null);
            }

            if ($entity->getErrors()) {
                $errors = [$i => $entity->getErrors()];
                throw new CustomValidationException(__('The tag metadata key data could not be updated.'), $errors); // phpcs:ignore
            }

            $entities[$i] = $entity;
        }

        try {
            $tagsTable->saveManyOrFail($entities, [
                IsV4ToV5UpgradeAllowedRule::SKIP_RULE_OPTION => true,
                IsSharedMetadataKeyUniqueActiveRule::SKIP_RULE_OPTION => false,
            ]);
        } catch (PersistenceFailedException $exception) { // @phpstan-ignore-line
            $this->handleSaveManyValidationException(
                $exception,
                $entities,
                __('The tag metadata key data could not be updated.')
            );
        } catch (Exception $exception) {
            throw new InternalErrorException(

View on GitHub (pinned to 31c1bbc10f)