API accessed over python - can't decrypt most metadata

API & Customization issues
1

I have a working passbolt instance (community edition), it’s working without issues for everyone with both the browser extension and the android app.
I’m trying to retrieve a password for a service via python (3.13), using python_gnupg and requests (via passbolt-python-api package).

I can login with my key, I can retrieve a list of resources, but when I try to decrypt the “metadata” attributes for the resources I hit a snag: I retrieve a list of 450 resources from the API, and trying to decrypt them with my private key leads to only 73 of them being correctly decrypted, for the other 377 resources the gnupg decrypt call results in no output.

Dumping some of them in a text file (one at a time, of course) and trying to manually decrypt them with gpg from command line gives this error:

gpg: encrypted with ECDH key, ID 5D63FC2A359597CE
gpg: public key decryption failed: No secret key
gpg: decryption failed: No secret key

I will add that doing the same (dump metadata in a file, decrypt with gpg) for a resource that my script does decrypt, correctly yelds the metadata JSON object, so I don’t think that my code is doing anything funky, but I don’t know where else to look.

Thanks to @gyaresu for pointing me here.
My initial goal was simply to retrieve a password via its name, which is now encrypted in the metadata object.

2

Hello @leandro-cyber,

Metadata for shared resources are not encrypted with your personal key, unlike personal resources. Instead there is a “shared metadata key” that has been shared with you and is available for you to download from the server. There are some security considerations (making sure you pin the metadata keys client side / verify signatures, etc.), so it’s best to have a look at the documentation:

See. https://docs.google.com/document/d/1yuucNxUJYcYFqsLUORTRqd4HZs1vROmtQQ6stGbdwpU/edit?tab=t.0#heading=h.knrk139hji0l

We’re working on SDKs, including Python SDK, as part of making secrets from passbolt available in Ansible. There is also some work being done in Go passbolt cli development branches, which supported encrypted metadata.

Cheers,

1 Like
3

Solved by importing the shared keys, thank you very much!
Just a simple clarification, if I load the shared keys filtering by “filter[expired]=0” and “filter[deleted]=0”, I should always get the latest “active” shared keys, is that correct?

4

Yes, that’s correct. Good you managed to make it work.