passbolt/passbolt_api · warning · Cake\Http\Exception\NotFoundException

Registration is not opened to public. Please contact your…

Error message

Registration is not opened to public. Please contact your administrator.

What it means

UsersRegisterController::assertIsSelfRegistrationOpen throws this NotFoundException when the configured self-registration settings are not open: either SelfRegistrationDryRunServiceInterface::isSelfRegistrationOpen() returns false, or the passbolt prevent-email-enumeration security setting is enabled. In both cases public registration is intentionally disabled and the controller pretends the page does not exist (404).

Solutions

Have an administrator open self-registration: configure the self-registration settings (e.g. allowed email domains) via the administration UI or `passbolt self_registration` command.
Check whether passbolt.security.prevent-email-enumeration is set to true in config and, if public registration is desired, disable it after assessing the trade-off.
Call GET /users/register (or the dry-run service) to probe whether registration is open before submitting payloads.
If registration is intentionally closed, use admin-initiated user creation (POST /users.json as admin) instead.

Example fix

// before
await client.post('/users/register.json', payload);
// after
const open = await dryRunService.isSelfRegistrationOpen();
if (open) {
  await client.post('/users/register.json', payload);
} else {
  console.warn('Self-registration disabled; contact administrator');
}

Defensive patterns

Strategy: validation

Validate before calling

// probe availability before submitting
const res = await fetch('/users/register');
if (res.status === 404) {
  console.warn('Self-registration is closed on this instance');
}

Try / catch

try {
  await api.post('/users/register.json', payload);
} catch (e) {
  if (e.status === 404 && /not opened to public/.test(e.message)) {
    // fall back to admin-created account or contact administrator
  }
}

Prevention

Configure self-registration settings (allowed email domains) before relying on public signup.
Check the prevent-email-enumeration security flag; it intentionally disables public registration.
Probe GET /users/register or the dry-run service before POSTing registration payloads.
Use admin user creation (POST /users.json) on instances where registration is closed.

When it happens

Trigger: GET /users/register or POST /users/register.json when (a) no self-registration provider is configured in passbolt (e.g. no email-domain rule set), or (b) the passbolt.security.prevent-email-enumeration config flag is true, which disables public registration to avoid leaking whether registration is available.

Common situations: Fresh passbolt instance where admins never configured self-registration settings; instance with prevent-email-enumeration enabled (common in hardened/enterprise setups); environment config drift between staging (open) and production (closed); caller code assuming registration is always available.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/bcf6db156e36ece0. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Users/UsersRegisterController.php:110

        // Assert that the user can self register, based on the payload and the self registration settings
        $dryRunService->canGuestSelfRegister(['email' => $this->getRequest()->getData('username')]);

        $user = $userRegisterService->register();

        $this->success(__('The operation was successful.'), $user);
    }

    /**
     * @param \Passbolt\SelfRegistration\Service\DryRun\SelfRegistrationDryRunServiceInterface $dryRunService dry run service
     * @return void
     * @throws \Cake\Http\Exception\NotFoundException if the user cannot register
     */
    protected function assertIsSelfRegistrationOpen(SelfRegistrationDryRunServiceInterface $dryRunService): void
    {
        if (!$dryRunService->isSelfRegistrationOpen()) {
            $msg = __('Registration is not opened to public.') . ' ';
            $msg .= __('Please contact your administrator.');
            throw new NotFoundException($msg);
        }
        if (Configure::read(UsersRecoverController::PREVENT_EMAIL_ENUMERATION_CONFIG_KEY)) {
            $msg = __('Registration is not opened to public.') . ' ';
            $msg .= __('This is due to a security setting.') . ' ';
            $msg .= __('Please contact your administrator.');
            throw new NotFoundException($msg);
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)