passbolt/passbolt_api · error · BadRequestException

Tag creation with cleartext metadata not allowed.

Error message

Tag creation with cleartext metadata not allowed.

What it means

Thrown when a tag is created with v4 cleartext metadata while the metadata types settings disallow v4 tag creation, i.e. only encrypted (v5) tags may be created. Raised by the ENTITY_TAG branch in the else ($isV5 === false) path of assertCreationAllowedByMetadataSettings.

Solutions

1. Create the tag using v5 encrypted metadata payload
2. Admin-side: enable v4 tag creation in metadata types settings if cleartext tags are still acceptable
3. Update tagging scripts/fixtures to the v5 format

Example fix

// before
$tag = ['slug' => 'prod'];
// after
$tag = ['slug' => $encryptedSlug, 'is_shared' => $encryptedBool]; // v5

$isPlainSlug = isset($tag['slug']) && !isset($tag['metadata_key_id']) && !isset($tag['is_shared']);
if ($isPlainSlug && !$settings->isV4TagCreationAllowed()) { /* convert to encrypted v5 tag */ }

function isV5TagPayload(array $t): bool { return isset($t['is_shared']) || isset($t['metadata_key_id']); }

try { $tag = $tagsService->create($data, $uac); }
catch (\Cake\Http\Exception\BadRequestException $e) { /* upgrade payload to v5 and retry */ }

When it happens

Trigger: Tag creation endpoints (POST /tags, tags on resource create) with plain slug payload while isV4TagCreationAllowed() returns false.

Common situations: Post-migration environments enforcing encrypted tags; scripts tagging resources with simple slug arrays; test fixtures/build data using v4 tag format.

Related errors

• Folder creation with cleartext metadata not allowed.
• Resource creation with cleartext metadata not allowed.
• Tag creation/modification with encrypted metadata not…
• The tag metadata key data could not be updated.
• The metadata could not be encrypted with the user id: .

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/3562d6640860cd35. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Utility/MetadataSettingsAwareTrait.php:107

                    throw new BadRequestException(__('Folder creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV5TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation/modification with encrypted metadata not allowed.')); // phpcs:ignore
                }
            }
        } else {
            if ($entity === MetadataTypesSettingsDto::ENTITY_RESOURCE) {
                if (!$settingsDto->isV4ResourceCreationAllowed()) {
                    throw new BadRequestException(__('Resource creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_FOLDER) {
                if (!$settingsDto->isV4FolderCreationAllowed()) {
                    throw new BadRequestException(__('Folder creation with cleartext metadata not allowed.'));
                }
            } elseif ($entity === MetadataTypesSettingsDto::ENTITY_TAG) {
                if (!$settingsDto->isV4TagCreationAllowed()) {
                    throw new BadRequestException(__('Tag creation with cleartext metadata not allowed.'));
                }
            }
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)