passbolt/passbolt_api · error · BadRequestException

Additional resource types are not enabled on this server.

Error message

Additional resource types are not enabled on this server.

What it means

ResourcesUpdateService::presetOrAssertResourceType defaults meta.resource_type_id to the default type, but if a caller supplies a non-default resource_type_id while the resourceTypes plugin is disabled (passbolt.plugins.resourceTypes.enabled is false), it throws BadRequestException (HTTP 400). Additional (v5-style) resource types are a plugin-gated feature; without the plugin only the default type is acceptable.

Solutions

1. Enable the resourceTypes plugin (passbolt.plugins.resourceTypes.enabled = true in config) if non-default types are required.
2. Omit resource_type_id from the meta payload so the default type is applied.
3. Send the default resource type id explicitly when the plugin is disabled.
4. Align client version/feature flags with server plugin state.

Example fix

// before
// config/passbolt.php
'plugins' => ['resourceTypes' => ['enabled' => false]],
// client sends: meta: { resource_type_id: 'v5-custom-uuid' }
// after
'plugins' => ['resourceTypes' => ['enabled' => byKey('passbolt.plugins.resourceTypes.enabled', true)]],
// or client sends no resource_type_id (default applies)

if (isset($meta['resource_type_id']) && $meta['resource_type_id'] !== ResourceTypesTable::getDefaultTypeId() && !Configure::read('passbolt.plugins.resourceTypes.enabled')) { /* drop or fix resource_type_id */ }

try { $service->update($uac, $id, $data); } catch (BadRequestException $e) { /* omit resource_type_id or enable plugin */ }

When it happens

Trigger: PUT /resources/{id} with meta.resource_type_id set to a custom/extended type while the resourceTypes plugin is disabled in config; clients sending resource_type_id unconditionally when the server runs without the plugin.

Common situations: Server upgraded or plugin disabled after clients adopted v5 resource types; config/passbolt.php missing the resourceTypes plugin enablement; mixed-version fleet where newer clients hit older servers.

Related errors

• A Duo state cookie is required.
• A Duo state cookie is required.
• Account recovery case must be a string.
• Account recovery is disabled.
• Account recovery reason not supported.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/608a625f1421de02. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/Resources/ResourcesUpdateService.php:142

        return $this->Resources->get($id);
    }

    /**
     * Make sure the default resource type is set on update to support backward compatibility checks
     * Also assert only default resource type is used if plugin is marked as disabled by admin
     *
     * @param array $meta The filtered request data
     * @throws \Cake\Http\Exception\BadRequestException if non default resource type is used when plugin is disabled
     * @return array updated $meta if needed
     */
    private function presetOrAssertResourceType(array $meta): array
    {
        $defaultType = ResourceTypesTable::getDefaultTypeId();
        if (!isset($meta['resource_type_id'])) {
            $meta['resource_type_id'] = $defaultType;
        } elseif (!Configure::read('passbolt.plugins.resourceTypes.enabled')) {
            if ($meta['resource_type_id'] !== $defaultType) {
                throw new BadRequestException(__('Additional resource types are not enabled on this server.'));
            }
        }

        return $meta;
    }

    /**
     * Extract the resource meta data from the request data
     *
     * @param \Passbolt\Metadata\Model\Dto\MetadataResourceDto $resourceDto The request data
     * @return array
     */
    private function extractDataResourceMeta(MetadataResourceDto $resourceDto): array
    {
        $meta = [];

        $data = $resourceDto->toArray();
        foreach ($resourceDto->getMetadataProps() as $metadataProp) {

View on GitHub (pinned to 31c1bbc10f)