passbolt/passbolt_api · error · BadRequestException

The subscription key cannot be verified.

Error message

The subscription key cannot be verified.

What it means

When reading the stored subscription key, SubscriptionKeyGetService::get raised SubscriptionSignatureException: the locally stored key does not pass signature verification, indicating a corrupted or tampered key file/record. Surfaced as HTTP 400.

Solutions

1. Re-submit a valid subscription key via POST /subscription.jsonapi to overwrite the corrupted stored key
2. Inspect the subscription_key table row for truncation or manual modifications
3. Restore from the license email/portal and re-apply the key
4. Check storage/filesystem integrity if corruption is recurring

Example fix

// before: DB contains hand-edited key -> 400 on GET /subscription
// after
curl -X POST .../subscription.jsonapi -d "data=<valid subscription key>"

// Periodically validate the stored key before it matters
const status = await fetch('/subscription.jsonapi', {headers});
if (status.status === 400 && (await status.json()).message.includes('cannot be verified')) {
  alertAdmin('Stored subscription key corrupted — re-apply a valid key');
}

const res = await fetch('/subscription.jsonapi', {headers});
if (res.status === 400 && res.body.message.includes('cannot be verified')) {
  await reapplyKeyFromOriginalSource();
}

When it happens

Trigger: GET /subscription.jsonapi where the persisted subscription key was modified, truncated, or written by an untrusted source so its signature check fails.

Common situations: Manual edits to the subscription record in the database; partial write/corruption during a failed update; restoring a DB backup with a mismatched key row.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• The subscription key cannot be verified.
• $e->getMessage() (from SubscriptionSignatureException)
• A subscription key is already present.
• Decryption failed. Invalid signature. Expected
• $e->getMessage() (from SubscriptionException)

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/db2db76341f40992. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Subscription/src/Controller/Subscriptions/SubscriptionsViewController.php:46

 * Class SubscriptionsCreateController
 */
class SubscriptionsViewController extends AppController
{
    /**
     * @return void
     * @throws \Exception
     */
    public function view()
    {
        if (!$this->User->isAdmin()) {
            throw new ForbiddenException(__('You are not allowed to access this location.'));
        }

        try {
            $service = new SubscriptionKeyGetService();
            $keyDto = $service->get($this->User->getAccessControl());
        } catch (SubscriptionSignatureException $e) {
            throw new BadRequestException($e->getMessage());
        } catch (SubscriptionException $e) {
            throw new PaymentRequiredException($e->getMessage(), $e->getErrors());
        }

        $this->success(__('The subscription is valid.'), $keyDto->toArray());
    }
}

View on GitHub (pinned to 31c1bbc10f)