What causes "Secret revisions settings endpoints are disabled." in passbolt/passbolt_api?

passbolt/passbolt_api · error · ForbiddenException

Secret revisions settings endpoints are disabled.

Error message

Secret revisions settings endpoints are disabled.

What it means

Thrown by SecretRevisionsSettingsMiddleware::process() when the Configure flag PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED is true; all secret-revisions settings endpoints are blocked with ForbiddenException (HTTP 403). This is an intentional security-setting gate, not a bug.

Solutions

Remove or set to false the PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED environment variable and restart
Check config/passbolt.default.php and your environment for the security.secretRevisionsSettingsEditionDisabled key
If the endpoint should stay disabled, use the admin UI/CLI path intended for your deployment instead of the API

Example fix

# before
PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED=true
# after
PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED=false

Defensive patterns

Strategy: try-catch

Validate before calling

if (config.get('passbolt.security.secretRevisionsSettingsEditionDisabled')) {
  // skip calling settings endpoints entirely
}

Try / catch

try {
  await api.getSecretRevisionsSettings();
} catch (e) {
  if (e.status === 403) { /* feature disabled on server — hide the settings UI */ }
  throw e;
}

Prevention

Check the deployment's PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED env var before integrating
Provision consistent env vars across environments
Hide dependent UI features when the server reports 403 on settings endpoints

When it happens

Trigger: Any request to secret revisions settings endpoints while the security config key passbolt.security.secretRevisionsSettingsEditionDisabled is set (typically via environment variable PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED=true).

Common situations: Self-hosted installs where the admin disabled secret-revisions settings endpoints for security hardening; environment variable accidentally set in one deployment; docs/proxies duplicating the flag across environments; tests verifying the endpoint is disabled.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7d9fb873ad6415cb. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/SecretRevisions/src/Middleware/SecretRevisionsSettingsMiddleware.php:41

use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class SecretRevisionsSettingsMiddleware implements MiddlewareInterface
{
    public const PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED =
        'passbolt.security.secretRevisions.settings.editionDisabled';

    /**
     * @param \Psr\Http\Message\ServerRequestInterface $request The request.
     * @param \Psr\Http\Server\RequestHandlerInterface $handler The handler.
     * @return \Psr\Http\Message\ResponseInterface The response.
     */
    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $handler
    ): ResponseInterface {
        if (Configure::read(self::PASSBOLT_SECURITY_SECRET_REVISIONS_SETTINGS_EDITION_DISABLED)) {
            throw new ForbiddenException(__('Secret revisions settings endpoints are disabled.'));
        }

        return $handler->handle($request);
    }
}

View on GitHub (pinned to 31c1bbc10f)