passbolt/passbolt_api · error · ValidationException

Could not validate policy data.

Error message

Could not validate policy data.

What it means

A ValidationException raised when building the account recovery organization policy entity: the newEntity() call produced field errors (e.g. invalid policy status/strategy or a bad public_key_id reference). The entity errors are attached to the exception so callers get field-level details.

Solutions

1. Inspect the exception's entity errors to see which field failed.
2. Use only supported policy values (e.g. 'opt-in'/'mandatory') for your server version.
3. Generate/associate a valid organization public key before setting the policy.
4. Re-run with the latest client to match current schema field names.

Example fix

// before
{ "policy": "yes" }
// after
{ "policy": "opt-in", "account_recovery_organization_public_key_id": "<valid-uuid>" }

const ALLOWED = ['opt-in','mandatory'];
if (!ALLOWED.includes(policy.policy)) throw new Error('unsupported policy value');
if (policy.account_recovery_organization_public_key_id && !isUuid(policy.account_recovery_organization_public_key_id)) throw new Error('bad key id');

function isUuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v); }

try { await api.saveOrganizationPolicy(policy); } catch (e) { if (e.body && e.body.account_recovery_organization_policy) { reportFieldErrors(e.body.account_recovery_organization_policy); } else { throw e; } }

When it happens

Trigger: POST/PUT /account-recovery/organization-policies with an invalid 'policy' value, a public_key_id that fails validation, or required fields missing per the table's validation rules.

Common situations: Client sends policy value not in the allowed enum after an upgrade; admin tries to enable the policy without a generated organization key; stale public_key_id pointing at a revoked key.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not validate password data.
• The account recovery request response is invalid.
• The request is invalid.
• Could not save the account recovery private key.
• Could not save the account recovery setting.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/5abee5cb5b4ce246. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Model/Table/AccountRecoveryOrganizationPoliciesTable.php:332

            'modified_by' => $uac->getId(),
        ];
        $accessibleFields = [
            'policy' => true,
            'created' => true,
            'modified' => true,
            'created_by' => true,
            'modified_by' => true,
        ];

        if (isset($publicKeyId)) {
            $data['public_key_id'] = $publicKeyId;
            $accessibleFields['public_key_id'] = true;
        }

        $newPolicy = $this->newEntity($data, ['accessibleFields' => $accessibleFields]);
        if ($newPolicy->getErrors()) {
            $em = __('Could not validate policy data.');
            throw new ValidationException($em, $newPolicy, $this);
        }

        return $newPolicy;
    }

    /**
     * Return a new org policy entity that is set to disabled
     *
     * @param \App\Utility\UserAccessControl $uac The user at the origin of the operation
     * @return \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryOrganizationPolicy entity ready to be saved
     */
    public function newEntityForDisable(UserAccessControl $uac): AccountRecoveryOrganizationPolicy
    {
        /** @var \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryOrganizationPolicy $policy */
        $policy = $this->newEntity([
                'policy' => AccountRecoveryOrganizationPolicy::ACCOUNT_RECOVERY_ORGANIZATION_POLICY_DISABLED,
                'created_by' => $uac->getId(),
                'modified_by' => $uac->getId(),

View on GitHub (pinned to 31c1bbc10f)