passbolt/passbolt_api · error · CustomValidationException

Invalid request. Private key or password are missing.

Error message

Invalid request. Private key or password are missing.

What it means

assertRules() throws this when the setting is approved (enrolling) but the required backup material is absent: no private key and/or no private key passwords provided. The structured errors mark the missing fields (_required).

Solutions

1. Include both account_recovery_private_key and account_recovery_private_key_passwords when enrolling
2. Verify the client completed key generation/encryption before submitting
3. Check the response errors object to see which field is missing
4. Upgrade the client if it targets an older payload schema

Example fix

// before
$service->set(['status' => 'approved']);
// after
$service->set(['status' => 'approved',
    'account_recovery_private_key' => $armoredKey,
    'account_recovery_private_key_passwords' => $passwords]);

if (status === 'approved' && (!privateKey || !passwords?.length)) throw new Error('approved status requires private key and passwords');

const hasBackup = (d) => Boolean(d.account_recovery_private_key) && Array.isArray(d.account_recovery_private_key_passwords) && d.account_recovery_private_key_passwords.length > 0;

try { await setSettings(data); } catch (e) { if (e.body?.account_recovery_user_setting?.account_recovery_private_key_passwords?._required) { /* prompt for backup */ } }

When it happens

Trigger: POST/PATCH with status=approved but an empty account_recovery_private_key, or missing account_recovery_private_key_passwords, in the payload; truncated form submissions.

Common situations: Client-side generation of the backup key failed silently; field names mismatched after an API version change; users submitting before the key export step completes.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Could not validate public key data.
• Could not validate response data.
• An authentication token should be provided.
• Could not save the account recovery private key.
• Could not save the account recovery setting.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/db3100c7e4f2b524. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryUserSettings/AccountRecoveryUserSettingsSetService.php:197

                        'isMatchingData' => __('The status must be set to approved.'),
                    ],
                ],
            ]);
        }

        if ($setting->isApproved() && (!$this->isPrivateKeyProvided() || !$this->arePasswordsProvided())) {
            $e = [];
            if (!$this->isPrivateKeyProvided()) {
                $e['account_recovery_user_setting']['account_recovery_private_key'] = [
                    '_required' => __('The private key backup must be provided.'),
                ];
            }
            if (!$this->arePasswordsProvided()) {
                $e['account_recovery_user_setting']['account_recovery_private_key_passwords'] = [
                    '_required' => __('The private key backup must be provided.'),
                ];
            }
            throw new CustomValidationException(__('Invalid request. Private key or password are missing.'), $e);
        }
    }

    /**
     * @throws \App\Error\Exception\CustomValidationException if the private key does not validate
     * @return \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryPrivateKey
     */
    protected function validateAccountRecoveryPrivateKey(): AccountRecoveryPrivateKey
    {
        $data = $this->data['account_recovery_private_key'] ?? [];
        try {
            // Entity validation &
            $privateKeyEntity = $this->AccountRecoveryPrivateKeys->buildAndValidateEntity($this->uac, $data);

            // Validate private key OpenPGP message &
            $rules = MessageValidationService::getSymmetricMessageRules();
            MessageValidationService::parseAndValidateMessage($privateKeyEntity->data, $rules);

View on GitHub (pinned to 31c1bbc10f)