passbolt/passbolt_api · warning · ForbiddenException

Metadata settings endpoints are disabled.

Error message

Metadata settings endpoints are disabled.

What it means

The metadata settings security middleware short-circuits all metadata settings endpoints when the config flag PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED is true, throwing a 403 ForbiddenException before the request is handled.

Solutions

1. Remove or set the flag to false: Configure 'passbolt.security.metadataSettings.editionDisabled' => false (or unset PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED env var).
2. Clear the cache after config changes (passbolt cache clear / restart).
3. Verify with the right edition: confirm the flag is intended for your deployment before disabling.

Example fix

// before (config/passbolt.php)
'security' => ['metadataSettings' => ['editionDisabled' => true]],
// after
'security' => ['metadataSettings' => ['editionDisabled' => false]],

// detect the disabled flag via a cheap settings check or deployment config
const disabled = await getServerSetting('passbolt.security.metadataSettings.editionDisabled');
if (disabled) hideMetadataSettingsUI();

try { await api.get('/metadata/settings'); } catch (e) { if (e.response?.status === 403 && String(e.message).includes('disabled')) { featureFlag.metadataSettings = false; return; } throw e; }

When it happens

Trigger: Any request to /metadata/settings endpoints while passbolt.security.metadataSettings.editionDisabled (PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED) is set true in config or environment.

Common situations: Pro installations with that security flag enabled; config copied from an environment where the flag was set; setting enabled via environment variable in deployments that later need metadata settings.

Related errors

• Secret revisions settings endpoints are disabled.
• Directory sync settings endpoints are disabled.
• SSO settings edit endpoints are disabled.
• Access restricted to administrators.
• Access to this service requires an invitation. Please…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7647c1933c5eee88. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Middleware/MetadataSettingsSecurityMiddleware.php:41

use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class MetadataSettingsSecurityMiddleware implements MiddlewareInterface
{
    public const PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED =
        'passbolt.security.metadata.settings.editionDisabled';

    /**
     * @param \Psr\Http\Message\ServerRequestInterface $request The request.
     * @param \Psr\Http\Server\RequestHandlerInterface $handler The handler.
     * @return \Psr\Http\Message\ResponseInterface The response.
     */
    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $handler
    ): ResponseInterface {
        if (Configure::read(self::PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED)) {
            throw new ForbiddenException(__('Metadata settings endpoints are disabled.'));
        }

        return $handler->handle($request);
    }
}

View on GitHub (pinned to 31c1bbc10f)