passbolt/passbolt_api · error · ValidationException

Could not validate public key data.

Error message

Could not validate public key data.

What it means

Thrown by `assertPublicKeyModelRules` when application-level model rules (`checkRules`) on an `AccountRecoveryOrganizationPublicKey` entity fail, i.e. the public key entity built from the request does not satisfy domain invariants. It wraps the table's validation errors in a `ValidationException`.

Solutions

1. Read the validation errors attached to the ValidationException response body
2. Verify the submitted `armored_key` is a valid armored OpenPGP public key (not private)
3. Ensure the key's fingerprint is not already registered in account_recovery_organization_public_keys
4. Regenerate the key with supported OpenPGP settings and retry

const armored = armor.isArmored(pubkey) && /BEGIN PGP PUBLIC KEY/.test(pubkey);
if (!armored) throw new Error('must be an armored public key');

function isArmoredPublicKey(s) { return typeof s === 'string' && s.includes('-----BEGIN PGP PUBLIC KEY BLOCK-----'); }

try { await submitKey(key); } catch (e) { if (e.status === 400 && e.body?.errors) showValidationErrors(e.body.errors); else throw e; }

When it happens

Trigger: Posting a new organization recovery public key that fails model rules such as valid armored-key format, unique fingerprint, or key type checks during `buildPublicKeyEntityFromDataOrFail`.

Common situations: Client sends a private key instead of a public key; key generated with algorithms the server rejects; duplicate fingerprint already registered; API version mismatch sending extra/missing fields.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not save the account recovery private key.
• Could not validate key revocation.
• Could not validate policy data.
• Could not validate public key data.
• The OpenPGP key can not be used to encrypt.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d089ddc065c5a136. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryOrganizationPolicies/AbstractAccountRecoveryOrganizationPolicySetService.php:354

                'account_recovery_organization_revoked_key' => $patchedEntity->getErrors(),
            ]);
        }

        return $patchedEntity;
    }

    /**
     * Run public key model rules and throw an exception in case of errors
     *
     * @param \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryOrganizationPublicKey $publicKey entity
     * @throws \App\Error\Exception\ValidationException if model rules fail
     * @return void
     */
    private function assertPublicKeyModelRules(AccountRecoveryOrganizationPublicKey $publicKey): void
    {
        $table = $this->AccountRecoveryOrganizationPublicKeys;
        if (!$table->checkRules($publicKey) && $publicKey->getErrors()) {
            throw new ValidationException(__('Could not validate public key data.'), $publicKey, $table);
        }
    }

    /**
     * Assert an organization recovery public key exists and is not deleted for given fingerprint
     *
     * @param string $fingerprint user provided data
     * @throws \App\Error\Exception\CustomValidationException if the provided fingerprint does not match the one
     * from the currently active key
     * @return \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryOrganizationPublicKey existing key
     */
    private function findActiveKeyByFingerprintOrFail(string $fingerprint): AccountRecoveryOrganizationPublicKey
    {
        try {
            /** @var \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryOrganizationPublicKey $key */
            $key = $this->AccountRecoveryOrganizationPublicKeys->find()->where([
                'fingerprint' => $fingerprint,
                'deleted IS' => null,

View on GitHub (pinned to 31c1bbc10f)