passbolt/passbolt_api · error · BadRequestException

The data must be a string.

Error message

The data must be a string.

What it means

BadRequestException thrown by the private assertData helper when the `data` payload for a new metadata session key is not a PHP string. The service requires the encrypted session key material to arrive as a raw string before any further processing.

Solutions

1. Send `data` as a plain string containing the encrypted session key material.
2. If your payload is an object, serialize it (JSON.stringify / json_encode) before assigning it to `data`.
3. Add a client-side check that `typeof data === 'string'` before issuing the request.

Example fix

// before
{ "data": { "key": "..." } }
// after
{ "data": "{\"key\": \"...\"}" }

function assertStringData(payload) {
  if (typeof payload.data !== 'string') throw new Error('data must be a string');
}
// PHP
if (!is_string($data)) throw new \InvalidArgumentException('data must be a string');

function isString(v) { return typeof v === 'string'; }

catch (BadRequestException) { // 400
  // serialize payload.data to a string and resend
}

When it happens

Trigger: POST to the metadata session keys endpoint with `data` as null, array, object, or integer — typically when the client sends the encrypted blob as structured JSON instead of a string.

Common situations: Client auto-parses the armored/encrypted payload into an object before sending; forgetting json_encode/stringify; API consumers experimenting with the endpoint passing unserialized values.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Service provider missing.
• Service provider not supported.
• The metadata session key could not be saved.
• The request data is invalid: id invalid.
• The request data is invalid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/73b6375cb9b9d97f. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyCreateService.php:78

                __('Could not save the metadata session key, please try again later.'),
                null,
                $e
            );
        }

        return $result;
    }

    /**
     * Basic sanity check for the given data value.
     *
     * @param mixed $data Data to check.
     * @return void
     */
    private function assertData(mixed $data): void
    {
        if (!is_string($data)) {
            throw new BadRequestException(__('The data must be a string.'));
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)