passbolt/passbolt_api · error · BadRequestException

Tag creation/modification with encrypted metadata not…

Error message

Tag creation/modification with encrypted metadata not allowed.

What it means

Thrown when a tag is created or modified with v5 encrypted metadata while the metadata settings disallow v5 tag creation. The trait's assertCreationAllowedByMetadataSettings ENTITY_TAG branch raises BadRequestException via assertV5TagCreationEnabled (or assertV4TagCreationEnabled checking the opposite side).

Solutions

Check the metadata types settings for the v5 tag creation flag
Submit tags with v4 cleartext slug format instead of encrypted metadata
Have an admin enable 'allow creation of v5 tags' if encrypted tags are intended
Update client tooling to negotiate metadata version per server settings

Example fix

// before
$tag = ['slug' => $encryptedSlug, 'is_shared' => $encBool]; // v5
// after
$tag = ['slug' => 'production']; // v4 cleartext

Defensive patterns

Strategy: validation

Validate before calling

// verify tag payload version before sending
$isV5 = isset($tag['is_shared']) || isset($tag['metadata_key_id']);
if ($isV5 && !$settings->isV5TagCreationAllowed()) { /* convert to plain slug */ }

Try / catch

try { $tag = $tagsService->create($data, $uac); }
catch (\Cake\Http\Exception\BadRequestException $e) { /* downgrade to v4 slug or abort with clear message */ }

Prevention

Only use encrypted tag payloads when server settings allow v5 tags
Default to v4 slugs in scripts unless v5 is explicitly enabled
Add an integration test per entity type (resource/folder/tag) x metadata version

When it happens

Trigger: POST /tags, tag update, or resource-with-tags creation carrying encrypted is_shared/shared metadata (v5 format) while isV5TagCreationAllowed() returns false.

Common situations: Admin disabled v5 tags in metadata types settings; CLI/scripts tagging resources with v5 payloads; mixed client fleets where some clients adopted v5 metadata before the admin locked settings down.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d714166601b6303b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php:93

        if (!$v5Enabled) {
            // No need to assert if format is v4 and v5 config is disabled
            return;
        }

        $settingsDto = MetadataTypesSettingsGetService::getSettings();

        if ($isV5) {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV5ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV5FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV5TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            }
        } else {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV4ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV4FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV4TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));
                }
            }
        }
    }

View on GitHub (pinned to 31c1bbc10f)