passbolt/passbolt_api · error · BadRequestException

Resource creation with cleartext metadata not allowed.

Error message

Resource creation with cleartext metadata not allowed.

What it means

The mirror case of error 260: thrown when a resource is created with v4 cleartext metadata while the metadata types settings require/allow only v5 (encrypted) metadata for new resources. This enforces migration toward encrypted metadata in environments where v4 creation has been disabled.

Solutions

1. Encrypt the resource metadata client-side and send v5 payload (metadata, metadata_key_id, signed metadata_key) instead of cleartext fields
2. If cleartext must be kept temporarily, have an admin re-enable v4 resource creation in metadata types settings
3. Update legacy importers/scripts to use the v5 metadata format and a user private key for encryption

Example fix

// before: v4 cleartext
$resource = ['name' => 'Secret login', 'username' => 'bob', 'uri' => 'https://x'];
// after: v5 encrypted metadata
$resource = ['resource_type_id' => $v5TypeId, 'metadata_key_id' => $keyId, 'metadata' => $openpgpEncryptedJson];

$isCleartext = empty($data['metadata']) && isset($data['name']);
if ($isCleartext && !$settings->isV4ResourceCreationAllowed()) { /* encrypt to v5 before sending */ }

function isV5ResourcePayload(array $d): bool { return isset($d['metadata'], $d['metadata_key_id']); }

try { $r = $service->create($data, $uac); }
catch (\Cake\Http\Exception\BadRequestException $e) { if (str_contains($e->getMessage(), 'cleartext metadata')) { /* encrypt metadata and retry as v5 */ } }

When it happens

Trigger: POST/PUT resource endpoints with plain-text metadata (name, username, description in clear) while isV4ResourceCreationAllowed() returns false (the $isV5 === false branch of assertCreationAllowedByMetadataSettings).

Common situations: Environments that completed the v5 migration and disabled v4 creation; legacy scripts or old clients still sending cleartext metadata; migrations/imports (e.g. KeePass/LastPass importers) that produce v4 resources; test suites using old fixtures.

Related errors

• Folder creation with cleartext metadata not allowed.
• Tag creation with cleartext metadata not allowed.
• The metadata could not be encrypted with the user id: .
• Few fields are missing for the V5.
• Folder can not be shared

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d74d5aa09106677a. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php:99

        if ($isV5) {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV5ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV5FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV5TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            }
        } else {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV4ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV4FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV4TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));
                }
            }
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)