passbolt/passbolt_api · error · BadRequestException

Resource creation/modification with encrypted metadata not…

Error message

Resource creation/modification with encrypted metadata not allowed.

What it means

Passbolt throws this BadRequestException when a client attempts to create or update a resource using v5 (encrypted) metadata while the metadata types settings configured by the administrator disallow v5 resource creation. The check is performed by assertCreationAllowedByMetadataSettings (MetadataSettingsAwareTrait) against settings fetched via MetadataTypesSettingsGetService. It is a server-side policy enforcement, not a data corruption issue.

Solutions

Check the metadata types settings (GET /metadata/types/settings.json or the metadata_types_settings table) and confirm allowCreationOfV5Resources is disabled
Either switch the client to send v4 cleartext metadata, or have an admin re-enable v5 resource creation in the metadata settings (org settings UI or MetadataTypesSettingsChangeService)
Upgrade/patch the calling client so it respects the server's advertised allowed metadata types before attempting creation
If running a migration campaign, temporarily enable v5 creation, complete the migration, then disable it

Example fix

// before: client forces v5 metadata
$resource = ['metadata_key_id' => $keyId, 'metadata' => $encrypted, 'resource_type_id' => $v5Type];
// after: honor server settings, fall back to v4
if (!$settings->isV5ResourceCreationAllowed()) {
    $resource = ['name' => $cleartextName, 'resource_type_id' => $v4Type]; // no encrypted metadata
}

Defensive patterns

Strategy: try-catch

Validate before calling

// PHP client: check settings before creating
$settings = $metadataTypesSettingsGetService->getSettings();
if ($settings->isV5ResourceCreationAllowed()) { /* send v5 payload */ } else { /* send v4 or abort */ }

Type guard

function canCreateV5Resource(\Passbolt\Metadata\Model\Dto\MetadataTypesSettingsDto $s): bool { return $s->isV5ResourceCreationAllowed(); }

Try / catch

try {
    $resource = $resourcesService->create($data, $uac);
} catch (\Cake\Http\Exception\BadRequestException $e) {
    if ($e->getMessage() contains 'encrypted metadata not allowed') { /* fall back to v4 or surface admin-settings message */ }
}

Prevention

Fetch and cache the server's metadata types settings at client startup
Gate all v5 metadata payloads behind the settings flags
Re-check settings after admin-driven config changes
Log which metadata version was used per request to ease diagnosis

When it happens

Trigger: POST/PUT to resource endpoints (or folder/tag flows) with v5 encrypted metadata while MetadataTypesSettingsDto::isV5ResourceCreationAllowed() returns false — i.e. assertV5ResourceCreationEnabled runs and the admin-disabled 'allow creation of v5 resources' flag is off.

Common situations: Admin disabled v5 (encrypted metadata) resource creation in metadata settings after clients already migrated; mobile/desktop/CLI clients defaulting to v5 metadata format; environments deliberately pinned to v4 cleartext metadata for compatibility (e.g. older clients or Pro/CE mixtures); after importing settings that only allow v4.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0c50c11048aa187a. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php:85

     */
    public function assertCreationAllowedByMetadataSettings(bool $isV5, string $entity): void
    {
        $v5Enabled = Configure::read('passbolt.v5.enabled');

        if (!$v5Enabled && $isV5) {
            throw new BadRequestException(__('V5 metadata format is not enabled.'));
        }
        if (!$v5Enabled) {
            // No need to assert if format is v4 and v5 config is disabled
            return;
        }

        $settingsDto = MetadataTypesSettingsGetService::getSettings();

        if ($isV5) {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV5ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV5FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV5TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            }
        } else {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV4ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV4FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));

View on GitHub (pinned to 31c1bbc10f)