passbolt/passbolt_api · error · ValidationException

Could not validate group user data.

Error message

Could not validate group user data.

What it means

GroupsUsersAddService::handleValidationErrors() throws App\Error\Exception\ValidationException with this message when a GroupsUser entity (or associated Secret entities) fails validation while adding a user to a group. The exception carries the entity and groupsUsersTable for field-level details.

Solutions

1. Check the response errors to see which field failed (user_id, group_id, secrets)
2. Verify the user is not already a member (GET group users) before adding
3. Ensure required Secret entities are provided for the added user when needed
4. Retry only after deduplicating pending add operations

const members = await api.get(`/groups/${groupId}/users`);
if (members.some(gu => gu.user.id === userId)) throw new Error('already a member');
const user = await api.get(`/users/${userId}`);
if (!user) throw new Error('user does not exist');

try {
  await api.post(`/groups/${groupId}/users`, { user_id: userId, secrets });
} catch (e) {
  if (e.response?.body?.errors) console.error('GroupUser errors:', e.response.body.errors);
  throw e;
}

When it happens

Trigger: POST to add a group user where validation fails: user already in the group, nonexistent user/group ids, missing required secrets for users added to a group with secrets, invalid secret payloads.

Common situations: Adding a user twice due to concurrent requests or UI retry; forgetting to provide encrypted secrets when required; referencing a user id from another instance.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• group(s) returned by your directory are invalid and will be…
• " " is not a valid contain value.
• " " is not a valid datetime for filter .
• " " is not a valid group filter.
• " " is not a valid group id for filter .

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d7db05ad45fead08. Report an issue: GitHub.

Appendix: source

Thrown at src/Service/GroupsUsers/GroupsUsersAddService.php:159

        $groupUser = $this->groupsUsersTable->newEntity($data, ['accessibleFields' => $accessibleFields]);
        if ($groupUser->hasErrors()) {
            $this->handleValidationErrors($groupUser);
        }

        return $groupUser;
    }

    /**
     * Handle group user validation errors.
     *
     * @param \App\Model\Entity\GroupsUser $groupUser The group user
     * @throws \App\Error\Exception\ValidationException If the group user has errors.
     * @return void
     */
    private function handleValidationErrors(GroupsUser $groupUser): void
    {
        $msg = __('Could not validate group user data.');
        throw new ValidationException($msg, $groupUser, $this->groupsUsersTable);
    }

    /**
     * Build the secrets entities.
     *
     * @param \App\Model\Entity\GroupsUser $groupUser The group user to add.
     * @param array $missingAccessResourcesIds The missing access resources ids.
     * @param array $secretsData The secrets data.
     * @return array
     * @throws \App\Error\Exception\ValidationException If it could not validate secrets data
     * @throws \App\Error\Exception\ValidationException If some required secrets are missing
     * @throws \App\Error\Exception\ValidationException If too many secrets are provided (Duplicate)
     */
    private function buildSecretsEntities(
        UserAccessControl $uac,
        GroupsUser $groupUser,
        array $missingAccessResourcesIds,
        array $secretsData = []

View on GitHub (pinned to 31c1bbc10f)