"Invalid response code 400" when updating Encryption-at-rest key

Issues
1

Issue Description

I’m trying to update my encryption-at-rest SMIME key as it has been renewed, but after pasting it and entering my password and hitting save, the web admin displays “Invalid response code 400” above the form.

Expected Behavior

Should be able to update the key without issue.

Actual Behavior

I get the error shown above, and the log output pasted below.

Relevant Log Output

2026-07-03T18:46:14Z INFO Authentication successful (auth.success) listenerId = “https”, localPort = 443, remoteIp = 172.23.0.1, remotePort = 41608, accountName = “”, accountId = 28
2026-07-03T18:46:14Z ERROR Bad resource parameters (resource.bad-parameters) listenerId = “https”, localPort = 443, remoteIp = 172.23.0.1, remotePort = 41608, reason = “missing field allow_spam_training”`

Stalwart Version

v0.15.x

Installation Method

Docker

Database Backend

RocksDB

Blob Storage

Filesystem

Search Engine

Internal

Directory Backend

Internal

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

The error means the JSON patch sent for encryptionAtRest is missing the allowSpamTraining field, which is part of the EncryptionSettings object (along with publicKey and encryptOnAppend). When you use the WebUI to update the S/MIME key on the account, it appears the form isn’t including that field in the submitted object, so the server rejects the patch with “missing field allow_spam_training”.

As a workaround, you can set the full encryptionAtRest object directly via JMAP (or stalwart-cli) including all three fields, for example:

"encryptionAtRest": {
  "@type": "Aes256",
  "publicKey": "<PublicKey id>",
  "encryptOnAppend": true,
  "allowSpamTraining": true
}

This bypasses the WebUI form issue since you supply the complete object rather than a partial patch. See the field reference for encryptionAtRest and EncryptionSettings here: AccountSettings | Stalwart

A human will follow up to confirm whether this is a WebUI form bug that needs fixing.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Solution was here - needed to update the webadmin.