passbolt/passbolt_api · error · ValidationException

Could not validate public key data.

Error message

Could not validate public key data.

What it means

A ValidationException thrown when the organization public key entity built in buildAndValidateEntity fails the table's validation rules (e.g. malformed armored key, missing fingerprint/fields). The failing entity is attached to the exception for field-level inspection.

Solutions

1. Inspect entity errors attached to the ValidationException.
2. Regenerate the organization key with a supported algorithm and full ASCII-armor output.
3. Ensure the armored_key includes complete BEGIN/END PGP blocks and valid fingerprint.
4. Check for encoding/line-ending mangling when transmitting the key.

Example fix

// before
"armored_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----" // truncated
// after
"armored_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...\n-----END PGP PUBLIC KEY BLOCK-----"

if (!key.armored_key?.includes('-----END PGP PUBLIC KEY BLOCK-----')) throw new Error('armored key incomplete');
if (!/^[A-F0-9]{40}$/i.test(key.fingerprint)) throw new Error('invalid fingerprint');

function isArmoredPublicKey(v) { return typeof v === 'string' && v.includes('-----BEGIN PGP PUBLIC KEY BLOCK-----') && v.includes('-----END PGP PUBLIC KEY BLOCK-----'); }

try { await api.saveOrganizationPublicKey(key); } catch (e) { if (e.body && e.body.account_recovery_organization_public_key) { reportFieldErrors(e.body.account_recovery_organization_public_key); } else { throw e; } }

When it happens

Trigger: Saving an organization recovery public key with an invalid OpenPGP armored key, missing required fields (armored_key, fingerprint), or data not matching column constraints.

Common situations: Client generates a key with an unsupported algorithm; armored key truncated or re-formatted (line endings) by intermediate code; copy-paste losing header/footer lines.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not validate public key data.
• The account recovery private key is not valid.
• Could not save the account recovery private key.
• Could not save the account recovery setting.
• Could not validate key revocation.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0e2934352a1425ff. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Model/Table/AccountRecoveryOrganizationPublicKeysTable.php:202

     * @throws \App\Error\Exception\ValidationException if entity validation fails
     * @return \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryOrganizationPublicKey
     */
    public function buildAndValidateEntity(UserAccessControl $uac, array $data): AccountRecoveryOrganizationPublicKey
    {
        $data['created_by'] = $uac->getId();
        $data['modified_by'] = $uac->getId();

        $publicKey = $this->newEntity($data, [
            'accessibleFields' => [
                'fingerprint' => true,
                'armored_key' => true,
                'created_by' => true,
                'modified_by' => true,
            ],
        ]);

        if ($publicKey->getErrors()) {
            throw new ValidationException(__('Could not validate public key data.'), $publicKey, $this);
        }

        return $publicKey;
    }

    /**
     * Format fingerprint data to remove spaces and set it to uppercase
     *
     * @param \Cake\Event\EventInterface $event event
     * @param \ArrayObject $data user provided data
     * @param \ArrayObject $options options
     * @return void
     */
    public function beforeMarshal(EventInterface $event, ArrayObject $data, ArrayObject $options): void
    {
        if (isset($data['fingerprint']) && is_string($data['fingerprint'])) {
            $data['fingerprint'] = strtoupper(str_replace(' ', '', $data['fingerprint']));
        }

View on GitHub (pinned to 31c1bbc10f)