passbolt/passbolt_api · error · ValidationException

The account recovery request response is invalid.

Error message

The account recovery request response is invalid.

What it means

Thrown by AccountRecoveryResponsesTable::buildAndValidateEntity when the account recovery response entity fails validation rules defined on the table (status inList, responder foreign model, request association, etc.). The response entity containing the errors is attached to the exception.

Solutions

1. Inspect the errors attached to the exception entity for the exact failing field
2. Ensure status is exactly 'approved' or 'rejected'
3. Ensure responder_foreign_model is 'AccountRecoveryOrganizationKey' with a valid matching foreign key
4. Verify the account_recovery_request_id references an existing pending request

Example fix

// before
{"status": "yes", "account_recovery_request_id": "<uuid>"}
// after
{"status": "approved", "account_recovery_request_id": "<uuid>", "responder_foreign_model": "AccountRecoveryOrganizationKey"}

function validateResponsePayload(p) {
  const errs = [];
  if (!['approved','rejected'].includes(p.status)) errs.push('status');
  if (!p.account_recovery_request_id) errs.push('account_recovery_request_id');
  if (p.responder_foreign_model !== 'AccountRecoveryOrganizationKey') errs.push('responder_foreign_model');
  return errs;
}

function isValidResponsePayload(p) {
  return ['approved','rejected'].includes(p.status)
    && typeof p.account_recovery_request_id === 'string'
    && p.responder_foreign_model === 'AccountRecoveryOrganizationKey';
}

try {
  await api.createAccountRecoveryResponse(payload);
} catch (e) {
  const fieldErrors = e.body?.errors ?? {};
  Object.entries(fieldErrors).forEach(([f, err]) => console.warn(f, err));
}

When it happens

Trigger: Creating a recovery response (POST /account-recovery/responses) with a status outside ['rejected','approved'], an invalid responder_foreign_model (only 'AccountRecoveryOrganizationKey' is allowed), a missing/unknown account_recovery_request_id, or a responder foreign key that does not match the model.

Common situations: Client submits a response before the organization recovery key is configured; missing required fields in the JSON payload; referencing a request UUID that does not exist; passing the wrong responder model name.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not validate password data.
• Could not validate policy data.
• The request is invalid.
• Could not save the account recovery private key.
• Could not save the account recovery setting.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/1bdc5a6a16278673. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/AccountRecovery/src/Model/Table/AccountRecoveryResponsesTable.php:263

            'modified_by' => $uac->getId(),
        ]);

        /** @var \Passbolt\AccountRecovery\Model\Entity\AccountRecoveryResponse $responseEntity */
        $responseEntity = $this->newEntity($data, [
            'accessibleFields' => [
                'account_recovery_request_id' => true,
                'responder_foreign_key' => true,
                'responder_foreign_model' => true,
                'data' => true,
                'status' => true,
                'created_by' => true,
                'modified_by' => true,
            ],
        ]);

        if ($responseEntity->getErrors()) {
            $msg = __('The account recovery request response is invalid.');
            throw new ValidationException($msg, $responseEntity, $this);
        }

        return $responseEntity;
    }

    /**
     * Delete all records where associated responses are deleted
     *
     * @param bool|null $dryRun false
     * @return int of affected records
     */
    public function cleanupHardDeletedAccountRecoveryRequests(?bool $dryRun = false): int
    {
        return $this->cleanupHardDeleted('AccountRecoveryRequests', $dryRun);
    }

    /**
     * Retrieves a list of cleanup methods (first-class callables) implemented by this table.

View on GitHub (pinned to 31c1bbc10f)