passbolt/passbolt_api · error · BadRequestException

Folder can not be shared

Error message

Folder can not be shared

What it means

MetadataFolderDto.assertShareable() enforces that a v5 (metadata-based) folder payload carries a shared metadata key; if the folder is v5 but its metadataKeyType is not TYPE_SHARED_KEY, it throws this 400 BadRequestException because folders must be encrypted with a shared key to remain shareable.

Solutions

1. Re-encrypt the folder metadata with the shared metadata key (metadata_key_type = 'shared_key').
2. Use the correct shared key id in the folder's metadata payload.
3. Keep personal (user) keys for personal items only; folders always use shared keys.

Example fix

// before
{folder: {metadata_key_id: userKeyId, metadata_key_type: 'user_key', ...}}
// after
{folder: {metadata_key_id: sharedKeyId, metadata_key_type: 'shared_key', ...}}

const meta = JSON.parse(decrypt(folder.metadata));
if (meta.object_type === 'FOLDER' && meta.metadata_key_type !== 'shared_key') throw new Error('folders require shared_key metadata');

const isShareableFolderMeta = (m) => m.object_type === 'FOLDER' && m.metadata_key_type === 'shared_key';

try { await api.put(`/folders/${id}`, payload); } catch (e) { if (e.response?.status === 400 && String(e.message).includes('Folder can not be shared')) { return reEncryptFolderWithSharedKey(folder); } throw e; }

When it happens

Trigger: Creating/updating a folder with v5 metadata whose key type is 'user_key' instead of 'shared_key'; moving a personal-key-encrypted item into a shared folder context.

Common situations: Clients reusing the personal metadata key for folders; migrated v4 folders re-encrypted with a user key; mixing folder/resource key-type rules.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Few fields are missing for the V5.
• Resource metadata key type is invalid.
• Could not validate folder data.
• Could not validate folder data.
• Could not validate folder data.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/2f233ac4c9d812b3. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Model/Dto/MetadataFolderDto.php:111

    }

    /**
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException If folder's metadata key type is not shared_key
     */
    public function assertShareable(): void
    {
        if (!$this->isFeaturePluginEnabled(MetadataPlugin::class)) {
            // no check if metadata plugin is not enabled
            return;
        }

        if (!$this->isV5()) {
            return;
        }

        if ($this->metadataKeyType !== MetadataKey::TYPE_SHARED_KEY) {
            throw new BadRequestException(__('Folder can not be shared'));
        }
    }

    /**
     * @return array
     */
    public function toArray(): array
    {
        return [
            'name' => $this->name,
            'folder_parent_id' => $this->folderParentId,
            'metadata' => $this->metadata,
            'metadata_key_id' => $this->metadataKeyId,
            'metadata_key_type' => $this->metadataKeyType,
        ];
    }

    /**

View on GitHub (pinned to 31c1bbc10f)