passbolt/passbolt_api · error · NotFoundException

The metadata session key does not exist or does not belong…

Error message

The metadata session key does not exist or does not belong to this user.

What it means

update() fetches the session key filtered by both id and user_id; a RecordNotFoundException is converted into a 404 NotFoundException meaning the key does not exist or is not owned by the current user.

Solutions

  1. Confirm the key exists for the authenticated user via the index endpoint
  2. Authenticate as the owning user
  3. Re-create the session key if it expired instead of updating
Defensive patterns

Strategy: try-catch

Validate before calling

$key = $table->find()->where(['id' => $id, 'user_id' => $uac->getId()])->first(); if (!$key) { throw new RuntimeException('no owned key'); }

Type guard

if ($key === null) { return; }

Try / catch

try { $service->update($uac, $id, $data); } catch (NotFoundException $e) { /* key missing or not owned */ }

Prevention

When it happens

Trigger: Update call with a valid UUID id that does not exist, was deleted, or belongs to another user than the UAC identity.

Common situations: Attempting to rotate another user's session key, stale id after key expiry, test fixtures referencing ids from a different database.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/72d594b1d5e5b358. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyUpdateService.php:75

        // 400 invalid user provided data, we expect [modified:<datetime>, data:<string>]
        $form = new MetadataSessionKeyUpdateForm();
        if (!$form->execute($data)) {
            throw new FormValidationException(__('Could not validate the data.'), $form);
        }
        $data = $form->getData();

        /** @var \Passbolt\Metadata\Model\Table\MetadataSessionKeysTable $metadataSessionKeysTable */
        $metadataSessionKeysTable = $this->fetchTable('Passbolt/Metadata.MetadataSessionKeys');

        try {
            /** @var \Passbolt\Metadata\Model\Entity\MetadataSessionKey $metadataSessionKey */
            $metadataSessionKey = $metadataSessionKeysTable
                ->find()
                ->where(['id' => $id, 'user_id' => $uac->getId()])
                ->firstOrFail();
        } catch (RecordNotFoundException $e) {
            // 404 session key entry does not exist or not for current user_id
            throw new NotFoundException(__('The metadata session key does not exist or does not belong to this user.'));
        }

        // 400 no changes to be made
        if ($data['data'] === $metadataSessionKey->get('data')) {
            throw new BadRequestException(__('The metadata session key data is identical.'));
        }
        // 409 if the modified date is not equal to the persisted session key one
        $asserTime = (new DateTime($data['modified']))->diffInSeconds($metadataSessionKey->get('modified')) === 0;
        if (!$asserTime) {
            throw new ConflictException(__('The metadata session key data has changed.'));
        }

        $metadataSessionKey = $metadataSessionKeysTable->patchEntity(
            $metadataSessionKey,
            ['data' => $data['data']],
            ['accessibleFields' => ['data' => true]]
        );

View on GitHub (pinned to 31c1bbc10f)