# Issues decrypting username in metadata (Resource Types) via API using Python

**URL:** <https://community.passbolt.com/t/issues-decrypting-username-in-metadata-resource-types-via-api-using-python/14259>\
**Category:** API & Customization issues\
**Created:** [April 8, 2026, 5:40pm UTC](https://community.passbolt.com/t/issues-decrypting-username-in-metadata-resource-types-via-api-using-python/14259 "2026-04-08T17:40:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wanderson](https://avatars.discourse-cdn.com/v4/letter/w/439d5e/32.png) [@Wanderson](https://community.passbolt.com/u/Wanderson)\
**Post date:** [April 8, 2026, 5:40pm UTC](https://community.passbolt.com/t/issues-decrypting-username-in-metadata-resource-types-via-api-using-python/14259/1 "2026-04-08T17:40:01Z")

</div>

Hi everyone,

I’ve been struggling for about two weeks with a specific issue regarding the decryption of credentials via the Passbolt API using a Python script.

**The Scenario:**  
I have a “robot” user (robot.rpa) which is part of an automation group. This group has access to several resources. My script successfully authenticates and can decrypt the **password** (the main secret) without any issues using the robot’s private GPG key.

**The Problem:**  
I cannot decrypt the **username** and **label** stored in the metadata (Resource Types). When I fetch the resource via API, the username field appears encrypted with a key that seems different from my robot’s private key.

I noticed that the fingerprint of the key associated with these metadata fields is `F9B59A220C9BD39E`. Since I can see the username perfectly fine through the Passbolt Web UI (and even inspect the decrypted data via DevTools), I know the robot user has the necessary permissions.

**What I’ve tried:**

- Re-sharing the resources.

- Creating/Editing new resources within the group.

- Leaving and re-joining the automation group.

- Using different Python libraries (like PGPy and gnupg).

**Technical Doubt:**  
Since the Web UI can decrypt this information, I assume the logic for decrypting the metadata (Resource Config/Types) might differ slightly from the main secret decryption. Is there a specific API endpoint or a “shared” group key logic that I should be calling to handle these metadata fields? Can I retrieve the necessary public/private parts to handle this specific fingerprint `F9B59A220C9BD39E` via API?

---

<div class="post-metadata">

**Author:** ![Wanderson](https://avatars.discourse-cdn.com/v4/letter/w/439d5e/32.png) [@Wanderson](https://community.passbolt.com/u/Wanderson)\
**Post date:** [April 8, 2026, 6:23pm UTC](https://community.passbolt.com/t/issues-decrypting-username-in-metadata-resource-types-via-api-using-python/14259/2 "2026-04-08T18:23:25Z")

</div>

From what I’ve seen, basically the metadata is encrypted with a shared key rather than the robot’s private key. In this case, how would I go about decrypting it

---

<div class="post-metadata">

**Author:** ![gyaresu](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/gyaresu/32/5320_2.png) [@gyaresu](https://community.passbolt.com/u/gyaresu)\
**Post date:** [April 10, 2026, 2:28am UTC](https://community.passbolt.com/t/issues-decrypting-username-in-metadata-resource-types-via-api-using-python/14259/3 "2026-04-10T02:28:11Z")

</div>

G’day Wanderson.

I share my [passbolt-api-tools](https://github.com/gyaresu/passbolt-api-tools) repo in hope that it gives you some ideas.

The usual caveats of it only being a set of learning exercises and if it breaks you get to keep both pieces. But maybe it can help you.

Cheers  
Gareth