passbolt/passbolt_api · error · BadRequestException

Folder creation/modification with encrypted metadata not…

Error message

Folder creation/modification with encrypted metadata not allowed.

What it means

Thrown when a client tries to create or modify a folder using v5 encrypted metadata while the metadata types settings forbid v5 folder creation. assertCreationAllowedByMetadataSettings evaluates the ENTITY_FOLDER branch and rejects with BadRequestException. Same policy mechanism as for resources/tags, scoped to folders.

Solutions

Verify the server's metadata settings and whether v5 folder creation is disabled
Use v4 cleartext folder metadata in the request, or ask an admin to enable v5 folder creation in metadata types settings
Update the integration to read the allowed metadata types from the server before creating folders

Example fix

// before
$folder = ['folder' => ['metadata' => $encryptedMetadata, 'metadata_key_id' => $kid]];
// after: send cleartext name when v5 folders are disallowed
$folder = ['folder' => ['name' => 'My folder']];

Defensive patterns

Strategy: try-catch

Validate before calling

$settings = MetadataTypesSettingsGetService::getSettings();
assert($settings->isV5FolderCreationAllowed() || 'use v4 folder payload');

Type guard

function v5FolderAllowed($settings): bool { return $settings->isV5FolderCreationAllowed(); }

Try / catch

try { $folder = $foldersService->create($data, $uac); }
catch (\Cake\Http\Exception\BadRequestException $e) { /* retry with cleartext v4 folder payload if allowed */ }

Prevention

Keep folder-creation code paths aligned with the metadata version the server allows
Test folder creation against both v4-only and v5-only settings in CI
Surface the server's allowed metadata types in client UI before form submission

When it happens

Trigger: Folder create/update endpoints called with encrypted (v5) metadata payload while MetadataTypesSettingsDto::isV5FolderCreationAllowed() returns false (assertV5FolderCreationEnabled).

Common situations: Admin disabled encrypted folders in metadata types settings; client SDK or API scripts hard-coding v5 folder payloads; post-migration environments where folders were intentionally kept on v4 cleartext metadata; automation (e.g. LDAP sync or provisioning scripts) written against v5 API assumptions.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/2cb16693740fdb52. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php:89

        if (!$v5Enabled && $isV5) {
            throw new BadRequestException(__('V5 metadata format is not enabled.'));
        }
        if (!$v5Enabled) {
            // No need to assert if format is v4 and v5 config is disabled
            return;
        }

        $settingsDto = MetadataTypesSettingsGetService::getSettings();

        if ($isV5) {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV5ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV5FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV5TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            }
        } else {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV4ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV4FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV4TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));

View on GitHub (pinned to 31c1bbc10f)