passbolt/passbolt_api · error · Cake\Http\Exception\BadRequestException

Recovery request cannot be created when user is not…

Error message

Recovery request cannot be created when user is not enrolled.

What it means

BadRequestException from assertUserIsEnrolled indicating the target user has no account recovery user settings or has explicitly rejected the program, so a recovery request cannot be created for them.

Solutions

1. Complete account recovery enrollment for the user (account recovery setup flow)
2. Admin: verify the organization policy is enabled and user settings status is 'accepted'
3. If user rejected recovery intentionally, use the normal (non-recovery) login flow

Example fix

// before
$userSettings->isRejected() === true // request refused
// after
run account-recovery setup for user so settings status = 'accepted', then retry the request

$settings = (new AccountRecoveryUserSettingsGetService())->get($userId); if ($settings === null || $settings->isRejected()) { // fall back to normal login flow }

null

try { $service->create($data); } catch (BadRequestException $e) { if (str_contains($e->getMessage(), 'not enrolled')) { redirectToNormalRecoveryFlow(); } }

When it happens

Trigger: POST /account-recovery/requests for a user whose account_recovery_user_settings row is absent, or whose status is 'rejected'.

Common situations: User never completed enrollment; organization policy was enabled after the user's setup so they were never enrolled; user disabled recovery in their settings; testing against a fresh user not run through account recovery setup.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• The request is already completed.
• Account recovery case must be a string.
• Account recovery is disabled.
• Account recovery reason not supported.
• An authentication token should be provided.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d33920823c17052b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Service/AccountRecoveryRequests/AccountRecoveryRequestCreateService.php:149

        $userId = $this->getData('user_id');
        if (!Validation::uuid($userId)) {
            throw new BadRequestException(__('The user identifier should be a valid UUID.'));
        }

        return $userId;
    }

    /**
     * @throws \Cake\Http\Exception\BadRequestException if organization policy is disabled
     * @return void
     */
    public function assertUserIsEnrolled(): void
    {
        $service = new AccountRecoveryUserSettingsGetService();
        $userSettings = $service->get($this->getData('user_id'));
        if (!isset($userSettings) || $userSettings->isRejected()) {
            $msg = __('Recovery request cannot be created when user is not enrolled.');
            throw new BadRequestException($msg);
        }
    }

    /**
     * Return the authentication from data if any
     *
     * @param string $userId the user uuid the token belongs to
     * @throws \Cake\Http\Exception\BadRequestException if no authentication token was provided
     * @throws \Cake\Http\Exception\BadRequestException if the authentication token is not a uuid
     * @throws \Cake\Http\Exception\BadRequestException if the authentication token is expired or invalid
     * @return \App\Model\Entity\AuthenticationToken
     */
    protected function getAndAssertToken(string $userId): AuthenticationToken
    {
        $token = $this->getData('authentication_token.token');
        if (!isset($token)) {
            throw new BadRequestException(__('An authentication token should be provided.'));
        }

View on GitHub (pinned to 31c1bbc10f)