passbolt/passbolt_api · error · CustomValidationException

Could not validate password data.

Error message

Could not validate password data.

What it means

A CustomValidationException thrown when one or more account recovery private key password entities fail validation during buildAndValidateEntities. The exception carries an 'account_recovery_private_key_passwords' map of per-index entity errors so callers can identify which password records failed.

Solutions

1. Read the errors map under account_recovery_private_key_passwords in the response to find failing indexes.
2. Ensure every password entry has valid recipient fingerprint and encrypted data fields.
3. Re-encrypt the private key password for the correct current organization key.
4. Update the client to the schema matching the server version.

Example fix

// before
{"account_recovery_private_key_passwords":[{"recipient_fingerprint":"XYZ"}]}
// after
{"account_recovery_private_key_passwords":[{"recipient_fingerprint":"<fingerprint>","data":"<encrypted-payload>"}]}

passwords.forEach(p => { if (!p.recipient_fingerprint || !p.data) throw new Error('each password entry needs recipient_fingerprint and data'); });

function isValidPasswordEntry(p) { return typeof p === 'object' && p !== null && typeof p.recipient_fingerprint === 'string' && typeof p.data === 'string' && p.data.length > 0; }

try { await api.createAccountRecoveryResponse(payload); } catch (e) { if (e.body?.account_recovery_private_key_passwords) { const failed = e.body.account_recovery_private_key_passwords; /* re-encrypt and retry failed indexes */ } else { throw e; } }

When it happens

Trigger: POST /account-recovery/responses (or key rotation flow) where a supplied private key password item misses required fields, has an invalid data/recipient format, or exceeds column lengths.

Common situations: Client encrypts the recovery private key password for the wrong recipient key; missing 'data' field for one recipient; schema drift after an upgrade adding new required fields; bulk payloads where only some items are malformed.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not validate policy data.
• The account recovery private key is not valid.
• The account recovery request response is invalid.
• The request is invalid.
• Could not save the account recovery private key.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/509dbb3a265d8fe6. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Model/Table/AccountRecoveryPrivateKeyPasswordsTable.php:253

        // Otherwise passwords are created with the keys during setup or user settings change
        if ($validationRules === 'rotateKeys') {
            $accessibleFields['private_key_id'] = true;
        }

        $passwordEntities = $this->newEntities($passwords, [
            'accessibleFields' => $accessibleFields,
            'validate' => $validationRules,
        ]);

        $errors = [];
        foreach ($passwordEntities as $i => $entity) {
            if ($entity->getErrors()) {
                $errors[$i] = $entity->getErrors();
            }
        }

        if (count($errors)) {
            throw new CustomValidationException(__('Could not validate password data.'), [
                'account_recovery_private_key_passwords' => $errors,
            ]);
        }

        return $passwordEntities;
    }

    /**
     * Delete all records where associated private key are deleted
     *
     * @param bool|null $dryRun false
     * @return int of affected records
     */
    public function cleanupHardDeletedAccountRecoveryPrivateKeys(?bool $dryRun = false): int
    {
        return $this->cleanupHardDeleted('AccountRecoveryPrivateKeys', $dryRun);
    }

View on GitHub (pinned to 31c1bbc10f)