passbolt/passbolt_api · error · InternalErrorException

Could not retrieve the user key policies.

Error message

Could not retrieve the user key policies.

What it means

This InternalErrorException wraps any Throwable thrown while the UserKeyPoliciesGetSettingsController::get() action fetches the user key policy settings DTO. The controller logs the original message and rethrows a generic 500 so internal details are not leaked to the client. It indicates the settings service (e.g. organization settings lookup) failed unexpectedly, not a problem with the request itself.

Solutions

1. Check the application error log for the 'Log::error' entry emitted by this controller — the original exception message identifies the root cause.
2. Run database migrations and verify the organization settings storage is intact (ddev refresh or equivalent migrate command).
3. Verify the UserKeyPolicies plugin is correctly enabled and its settings service dependencies are configured.
4. If the underlying error is transient (DB connection), retry the request after restoring database connectivity.

Example fix

// before (server-side)
throw new InternalErrorException(__('Could not retrieve the user key policies.'), null, $error);
// after (caller-side guard)
try {
    $response = $http->get('/user-key-policies/settings.json');
} catch (HttpException $e) {
    if ($e->getCode() === 500) {
        // inspect server logs for the wrapped root cause before retrying
    }
}

// No client-side validation; ensure connectivity beforehand
if (!isReachable(apiBaseUrl)) { throw new Error('API unreachable'); }

try {
  const res = await api.get('/user-key-policies/settings.json');
} catch (e) {
  if (e.response && e.response.status === 500) {
    // 500 is opaque: check server logs for the wrapped cause; retry only if transient
  }
}

When it happens

Trigger: Calling GET /user-key-policies/settings when the underlying UserPassphraseGetSettingsService::get() throws — e.g. the organization settings row cannot be read from the database, the settings payload fails to decode, or any unexpected exception occurs inside the service.

Common situations: Database outages or migration drift leaving the organization settings table missing/corrupt; corrupted or invalid serialized settings; a plugin misconfiguration causing the service to throw during retrieval; the API response hides the root cause so the error log must be checked.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• Could not find the user data after save. Maybe it has been…
• Could not save the metadata session key, please try again…
• Could not save the rbacs, please try again later.
• Could not save the user data. Please try again later.
• The metadata private key could not be updated. Please try…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/ae0a945d3b5946a9. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php:64

    }

    /**
     * Returns user key policies settings.
     *
     * @return void
     */
    public function get(): void
    {
        $this->assertQueryParameters();

        $userPassphraseGetSettingsService = new UserKeyPoliciesGetSettingsService();
        try {
            $userKeyPoliciesSettingsDto = $userPassphraseGetSettingsService->get();

            $this->success(__('The operation was successful.'), $userKeyPoliciesSettingsDto->toArray());
        } catch (Throwable $error) {
            Log::error($error->getMessage());
            throw new InternalErrorException(__('Could not retrieve the user key policies.'), null, $error);
        }
    }

    /**
     * This method verifies that a guest user can be authenticated with a valid user ID and authentication token.
     *
     * @return void
     * @throws \Cake\Http\Exception\ForbiddenException If the user is a guest and neither a user ID nor an authentication token is provided.
     * @throws \Cake\Http\Exception\BadRequestException If the provided user ID is not a valid UUID.
     * @throws \Cake\Http\Exception\BadRequestException If the provided authentication token is not a valid UUID.
     * @throws \Cake\Http\Exception\ForbiddenException If no valid authentication token is found.
     */
    private function assertQueryParameters(): void
    {
        $isLoggedIn = !$this->User->isGuest();
        $isUserToken = $this->getRequest()->getQuery('user_id', false) || $this->getRequest()->getQuery('token', false);

        if ($isLoggedIn) {

View on GitHub (pinned to 31c1bbc10f)