What causes "No active admins were found." in passbolt/passbolt_api?

Create or reactivate an admin account (e.g. passbolt createuser or reactivation command) before importing the subscription

passbolt/passbolt_api · error · SubscriptionException

No active admins were found.

Error message

No active admins were found.

What it means

SubscriptionImportCommand::buildAdminUac fetches the first active admin via UsersTable::findFirstAdmin() to author the subscription import operation. If no active admin exists it throws SubscriptionException('No active admins were found.'). The command cannot proceed without an admin identity to act as.

Solutions

Create or reactivate an admin account (e.g. passbolt createuser or reactivation command) before importing the subscription
Verify the users table has a user linked to the admin role with active=true and deleted=false
Run the import only after first-run setup is complete

Example fix

// before
bin/cake passbolt subscription_import key.txt // fails with no admin
// after
bin/cake passbolt createuser --first-name Admin --last-name User --username admin@example.com --role admin
bin/cake passbolt subscription_import key.txt

Defensive patterns

Strategy: validation

Validate before calling

$admins = $usersTable->find('active')->matching('Roles', fn($q) => $q->where(['Roles.name' => 'admin']))->count();
if ($admins === 0) { /* abort: seed an admin first */ }

Type guard

$firstAdmin = $usersTable->findFirstAdmin();
if ($firstAdmin === null) { /* handle missing admin */ }

Try / catch

try {
    $command->execute($args, $io);
} catch (SubscriptionException $e) {
    $io->error($e->getMessage()); // create an admin, then re-run
}

Prevention

Seed at least one active admin during provisioning
Verify first-run setup completed before import commands
Monitor for deactivated/deleted admins in alerting

When it happens

Trigger: Running the subscription import command on an instance whose users table contains no active (non-deleted, non-disabled) administrator account.

Common situations: Fresh/migrated database without admin seeding; all admins deactivated or deleted during cleanup; running the command before completing first-run setup; restoring a backup with only regular users.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/65fcd4ade75d9d42. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Edition/src/Command/SubscriptionImportCommand.php:160

            $this->abort();
        }

        $this->success(__('The subscription key was successfully imported in the database.'), $io);

        return $this->successCode();
    }

    /**
     * @return \App\Utility\UserAccessControl
     * @throws \Passbolt\Subscription\Error\Exception\Subscriptions\SubscriptionException If no active admin exists.
     */
    private function buildAdminUac(): UserAccessControl
    {
        /** @var \App\Model\Table\UsersTable $usersTable */
        $usersTable = $this->fetchTable('Users');
        $firstAdmin = $usersTable->findFirstAdmin();
        if ($firstAdmin === null) {
            throw new SubscriptionException(__('No active admins were found.'));
        }

        return new UserAccessControl(Role::ADMIN, $firstAdmin->id);
    }
}

View on GitHub (pinned to 31c1bbc10f)