passbolt/passbolt_api · error · ValidationException

The metadata private key could not be validated.

Error message

The metadata private key could not be validated.

What it means

Thrown by MetadataPrivateKeysCreateService::handleValidationErrors when the MetadataPrivateKey entity fails table validation before save. It wraps a ValidationException carrying the entity and table, so callers receive the field-level errors; in debug mode the errors are also logged.

Solutions

1. Read the errors array in the ValidationException response and fix the flagged fields
2. Ensure 'data' contains a valid, signed OpenPGP message armored key material
3. Ensure 'user_id' is a valid UUID of an existing user (or omit for the server key)
4. Regenerate the metadata private key payload with an up-to-date client matching the server's expected format

Example fix

// before
{"data": "-----BEGIN PGP MESSAGE-----"} // truncated/invalid armor
// after
{"user_id": "<valid-uuid>", "data": "<complete armored OpenPGP message>"}

const ok = typeof data.data === 'string' && data.data.startsWith('-----BEGIN PGP MESSAGE-----') && (data.user_id === undefined || UUID_RE.test(data.user_id));

function isValidPayload(d) { return typeof d?.data === 'string' && (d.user_id === undefined || UUID_RE.test(d.user_id)); }

catch (e) { if (e.response?.status === 422 && e.response?.body?.errors) { mapEntityErrors(e.response.body.errors); } throw e; }

When it happens

Trigger: create() is called with data that fails MetadataPrivateKeysTable rules — e.g. missing or invalid 'data' (OpenPGP packet), bad user_id, or server/user key payload not matching the table's validation rules.

Common situations: Client sending plaintext or malformed armored key data instead of a properly signed OpenPGP message; missing user_id for user-key shares; schema changes between server versions altering required fields.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• The metadata private key data is not valid.
• A valid OpenPGP key must be provided.
• A valid OpenPGP key must be provided.
• Could not delete the resource.
• Could not save the account recovery private key.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7d563bfe1b09a031. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Service/MetadataPrivateKeysCreateService.php:106

        return $created;
    }

    /**
     * Handle validation or build rules failure
     *
     * @param \Passbolt\Metadata\Model\Entity\MetadataPrivateKey $entity that is failing the validation
     * @param \Passbolt\Metadata\Model\Table\MetadataPrivateKeysTable $table table
     * @throws \App\Error\Exception\ValidationException
     * @return void
     */
    protected function handleValidationErrors(MetadataPrivateKey $entity, MetadataPrivateKeysTable $table): void
    {
        if (Configure::read('debug')) {
            Log::error(json_encode($entity->getErrors()));
        }
        $msg = __('The metadata private key could not be validated.');
        throw new ValidationException($msg, $entity, $table);
    }

    /**
     * @param \App\Utility\UserAccessControl $uac user access control
     * @param string $metadataKeyId key id
     * @param array $data user provided data
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException If provided data is invalid.
     * @throws \Cake\Http\Exception\NotFoundException If given metadata key is deleted or doesn't exist.
     */
    protected function assertRequestSanity(UserAccessControl $uac, string $metadataKeyId, array $data): void
    {
        $uac->assertIsAdmin();
        if (!Validation::uuid($metadataKeyId)) {
            throw new BadRequestException(__('The request data is invalid.'));
        }
        if (isset($data['user_id']) && !Validation::uuid($data['user_id'])) {
            throw new BadRequestException(__('The request data is invalid.'));

View on GitHub (pinned to 31c1bbc10f)