passbolt/passbolt_api · error · BadRequestException

Folder creation with cleartext metadata not allowed.

Error message

Folder creation with cleartext metadata not allowed.

What it means

Thrown when a folder is created with v4 cleartext metadata while metadata settings disallow v4 folder creation. The ENTITY_FOLDER branch of the $isV5 === false path rejects the request with BadRequestException, pushing clients toward encrypted folder metadata.

Solutions

1. Send the folder with encrypted v5 metadata (metadata + metadata_key_id) instead of cleartext name
2. Admin-side: re-enable v4 folder creation in metadata types settings if the environment still needs cleartext folders
3. Upgrade the integrating client to support v5 folder metadata encryption

Example fix

// before
$folder = ['folder' => ['name' => 'HR']];
// after: v5 encrypted folder
$folder = ['folder' => ['metadata' => $encryptedJson, 'metadata_key_id' => $keyId]];

if (isset($folder['name']) && empty($folder['metadata']) && !$settings->isV4FolderCreationAllowed()) { /* build v5 encrypted folder payload */ }

function isV5FolderPayload(array $f): bool { return isset($f['metadata'], $f['metadata_key_id']); }

try { $folder = $foldersService->create($data, $uac); }
catch (\Cake\Http\Exception\BadRequestException $e) { /* switch payload to v5 or inform admin to relax settings */ }

When it happens

Trigger: Folder create/update endpoints receiving a plain 'name' (cleartext) payload while isV4FolderCreationAllowed() returns false (assertV5FolderCreationEnabled context).

Common situations: Orgs enforcing v5-only metadata after migration; folder-creation scripts (provisioning, LDAP sync) still sending clear names; clients that haven't implemented folder metadata encryption yet.

Related errors

• Folder creation/modification with encrypted metadata not…
• Folder ID " " is already V5
• Resource creation with cleartext metadata not allowed.
• Tag creation with cleartext metadata not allowed.
• The metadata could not be encrypted with the user id: .

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/b5729968037d48cd. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php:103

                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV5FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV5TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            }
        } else {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV4ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV4FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV4TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));
                }
            }
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)