passbolt/passbolt_api · error · BadRequestException

The settings selected by your administrator prevent from…

Error message

The settings selected by your administrator prevent from downgrading tag.

What it means

UpdatePersonalTagService::assertV4DowngradeAllowed checks the instance-wide MetadataTypesSettingsGetService settings before letting a tag be edited as V4. If the administrator has disallowed V4 downgrade (metadata types settings do not permit isV4DowngradeAllowed), any attempt to update a tag through the legacy V4 path is rejected with this BadRequestException.

Solutions

1. Update the client to use the V5 metadata tag endpoints instead of the legacy V4 tag update.
2. If V4 tags must still be editable, have an administrator allow V4 downgrade in the metadata types settings (metadata-types-settings endpoint).
3. Verify the current policy first via GET /metadata/types/settings so clients can disable the legacy path proactively.

const settings = await getMetadataTypesSettings(); if (!settings.allowV4Downgrade) useV5TagApi();

catch (err) { if (isBadRequest(err, 'prevent from downgrading tag')) { switchToV5MetadataFlow(); } else { throw err; } }

When it happens

Trigger: Updating a personal tag while the organization's metadata types settings have V4 downgrade disabled, i.e. MetadataTypesSettingsGetService::getSettings()->isV4DowngradeAllowed() returns false.

Common situations: Organization fully migrated to V5 metadata and the admin enforced it; older client versions still posting V4-style tag updates against a hardened instance; test/staging environments cloned from a production instance with strict metadata settings.

Related errors

• Tag creation/modification with encrypted metadata not…
• Tag creation with cleartext metadata not allowed.
• The tag metadata key data could not be updated.
• You do not have the permission to change a personal tag…
• 400

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/c0554dbb785932c7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Tags/src/Service/Tags/UpdatePersonalTagService.php:148

        }
    }

    /**
     * @param \Passbolt\Tags\Model\Entity\Tag $tag Existing tag entity.
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException If v5_to_v4_downgrade is disabled.
     */
    private function assertV4DowngradeAllowed(Tag $tag): void
    {
        // We consider a tag downgrade when current tag's slug is null and request contains slug field (not empty)
        if (!is_null($tag->slug)) {
            return;
        }

        $metadataTypesSettings = MetadataTypesSettingsGetService::getSettings();

        if (!$metadataTypesSettings->isV4DowngradeAllowed()) {
            throw new BadRequestException(__('The settings selected by your administrator prevent from downgrading tag.')); // phpcs:ignore
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)