phacility/phabricator · error · Exception

This transaction group requires MFA to apply, but you can no

Error message

This transaction group requires MFA to apply, but you can not provide an MFA response via Conduit. Edit this object via the web UI.

What it means

When a transaction group has MFA requirements (e.g. an MFA-signed transaction type), the editor needs a live request to run the high-security workflow. If no request is configured and the content source is Conduit, Phabricator refuses because MFA challenges cannot be answered through Conduit; with any other source it reports that the editor lacks a Request.

Source

Thrown at src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php:5480

    $object_phid = $object->getPHID();
    if ($object_phid) {
      $workflow_key = sprintf(
        'editor(%s).phid(%s)',
        $editor_class,
        $object_phid);
    } else {
      $workflow_key = sprintf(
        'editor(%s).new()',
        $editor_class);
    }

    $request = $this->getRequest();
    if ($request === null) {
      $source_type = $this->getContentSource()->getSourceTypeConstant();
      $conduit_type = PhabricatorConduitContentSource::SOURCECONST;
      $is_conduit = ($source_type === $conduit_type);
      if ($is_conduit) {
        throw new Exception(
          pht(
            'This transaction group requires MFA to apply, but you can not '.
            'provide an MFA response via Conduit. Edit this object via the '.
            'web UI.'));
      } else {
        throw new Exception(
          pht(
            'This transaction group requires MFA to apply, but the Editor was '.
            'not configured with a Request. This workflow can not perform an '.
            'MFA check.'));
      }
    }

    $cancel_uri = $this->getCancelURI();
    if ($cancel_uri === null) {
      throw new Exception(
        pht(
          'This transaction group requires MFA to apply, but the Editor was '.

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Perform the MFA-requiring edit from the web UI, which has a request and can issue the challenge.
2. For code-driven editors inside controllers, pass the request: $editor->setRequest($request) before applyTransactions().
3. Remove or replace the MFA-signing transaction type in automated workflows so the group no longer requires MFA.
4. In scripts that must run headless, configure the editor so it does not include REQUIRE_MFA transaction types.

Example fix

// before
id(new ManiphestTransactionEditor())
  ->setActor($viewer)
  ->setContentSource($source)
  ->applyTransactions($task, $xactions); // contains MFA xaction

// after
id(new ManiphestTransactionEditor())
  ->setActor($viewer)
  ->setContentSource($source)
  ->setRequest($request) // from the controller handling the edit
  ->applyTransactions($task, $xactions);

// In headless workflows, refuse MFA groups before applying
$source_type = $source->getSourceTypeConstant();
if ($requires_mfa && $source_type === PhabricatorConduitContentSource::SOURCECONST) {
  // route the caller to the web UI instead of failing mid-apply
  throw new Exception(pht('This edit must be performed via the web UI.'));
}
// In controllers, always provide the request:
$editor->setRequest($request);

try {
  $editor->applyTransactions($object, $xactions);
} catch (Exception $ex) {
  if (strpos($ex->getMessage(), 'requires MFA') !== false) {
    // Tell the user to redo the action in the web UI
    return $this->newDialog()->appendChild($ex->getMessage());
  }
  throw $ex;
}

When it happens

Trigger: Applying MFA-requiring transactions through a Conduit method (maniphest.edit, differential.revision.edit, ...), or calling applyTransactions() from a daemon/script on an editor built with setActor()+setContentSource() but no setRequest().

Common situations: Bots automating edits that policy flags as requiring MFA; one-off bin/ scripts or scheduled daemons performing sign-worthy actions; developers testing editors from CLI without simulating a request.

Related errors

• This comment was signed with MFA, so edits to it must also b
• Invalid response token for this challenge: token digest does
• The "Has MFA" query constraint may only be used by administr
• Service "%s" is unrecognized, restricted, or you do not have
• Service type "%s" is unrecognized. Valid types are: %s.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/3931ee110f97e85e. Report an issue: GitHub.