FIELD_INTEGRITY_EXCEPTION when trying to update/create metadata records in managed package

Question

We are using mdapi to create/update metadata records in a managed package. Everything works fine in the packaging as well as any other developer orgs. However, when we install the beta package in a different org, MetadataService.upsertMetadata returns a FIELD_INTRGRITY_EXCEPTION. But this error doesn't report which field has issue.

Attaching the JSON formatted result of MetadataService.upsertMetadata call. Any help would be greatly appreciated!

    {
  "success_type_info": [
    "success",
    "http://soap.sforce.com/2006/04/metadata",
    null,
    "1",
    "1",
    "false"
  ],
  "success": false,
  "fullName_type_info": [
    "fullName",
    "http://soap.sforce.com/2006/04/metadata",
    null,
    "1",
    "1",
    "false"
  ],
  "fullName": "NSAGN__API_Setting__mdt.NSAGN__Record2",
  "field_order_type_info": [
    "created",
    "errors",
    "fullName",
    "success"
  ],
  "errors_type_info": [
    "errors",
    "http://soap.sforce.com/2006/04/metadata",
    null,
    "0",
    "-1",
    "false"
  ],
  "errors": [
    {
      "statusCode_type_info": [
        "statusCode",
        "http://soap.sforce.com/2006/04/metadata",
        null,
        "1",
        "1",
        "false"
      ],
      "statusCode": "FIELD_INTEGRITY_EXCEPTION",
      "message_type_info": [
        "message",
        "http://soap.sforce.com/2006/04/metadata",
        null,
        "1",
        "1",
        "false"
      ],
      "message": "Cannot create: CustomMetadata in this organization",
      "fields_type_info": [
        "fields",
        "http://soap.sforce.com/2006/04/metadata",
        null,
        "0",
        "-1",
        "false"
      ],
      "fields": null,
      "field_order_type_info": [
        "extendedErrorDetails",
        "fields",
        "message",
        "statusCode"
      ],
      "extendedErrorDetails_type_info": [
        "extendedErrorDetails",
        "http://soap.sforce.com/2006/04/metadata",
        null,
        "0",
        "-1",
        "false"
      ],
      "extendedErrorDetails": null,
      "apex_schema_type_info": [
        "http://soap.sforce.com/2006/04/metadata",
        "true",
        "false"
      ]
    }
  ],
  "created_type_info": [
    "created",
    "http://soap.sforce.com/2006/04/metadata",
    null,
    "1",
    "1",
    "false"
  ],
  "created": false,
  "apex_schema_type_info": [
    "http://soap.sforce.com/2006/04/metadata",
    "true",
    "false"
  ]
}

Answer 1

The developer can modify protected records only with a package upgrade. The subscriber can’t read or modify protected records. The developer name of a protected record can’t be changed after release.

Try by keeping custom metadata visibility to Protected & setting Protected Component = false on metadata record.

Ref : Custom Metadata Type__mdt