Significant-Gravitas/AutoGPT · error · HTTPException

User not found

Error message

User not found

What it means

Raised by POST /api/invitations/{token}/accept when the authenticated user_id (from Security(get_user_id)) has no row in the User table. The token is valid, but the caller's identity does not resolve to a known user — typically a Supabase auth user that was deleted after the JWT was issued, or an inconsistent auth DB. HTTP 401.

Source

Thrown at autogpt_platform/backend/backend/api/features/orgs/invitation_routes.py:162

)
async def accept_invitation(
    token: str,
    user_id: Annotated[str, Security(get_user_id)],
) -> dict:
    invitation = await prisma.orginvitation.find_unique(where={"token": token})
    if invitation is None:
        raise NotFoundError("Invitation not found")
    if invitation.acceptedAt is not None:
        raise HTTPException(400, detail="Invitation already accepted")
    if invitation.revokedAt is not None:
        raise HTTPException(400, detail="Invitation has been revoked")
    if invitation.expiresAt < datetime.now(timezone.utc):
        raise HTTPException(400, detail="Invitation has expired")

    # Verify the accepting user's email matches the invitation
    accepting_user = await prisma.user.find_unique(where={"id": user_id})
    if accepting_user is None:
        raise HTTPException(401, detail="User not found")
    if accepting_user.email.lower() != invitation.email.lower():
        raise HTTPException(
            403,
            detail="This invitation was sent to a different email address",
        )

    # Add user to org (idempotent — handles race condition from concurrent accepts)
    try:
        await org_db.add_org_member(
            org_id=invitation.orgId,
            user_id=user_id,
            is_admin=invitation.isAdmin,
            is_billing_manager=invitation.isBillingManager,
            invited_by=invitation.invitedByUserId,
        )
    except UniqueViolationError:
        # User is already a member — treat as success (idempotent)
        pass

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Have the user log out and back in to obtain a fresh token; if the account was deleted, re-register first.
2. Verify the User row exists: prisma.user.find_unique(where={'id': user_id}).
3. If auth and application users are out of sync, re-run the user provisioning/sync flow (Supabase webhook) for that account.
4. Do not retry the accept with the same token until identity is fixed — the token itself is fine.

const user = await api.get('/api/user/me').catch(() => null);
if (!user) { await reauthenticate(); }

try {
  await api.post(`/api/invitations/${token}/accept`);
} catch (e) {
  if (e.status === 401) { await logout(); await login(); await retryAccept(); return; }
  throw e;
}

When it happens

Trigger: Accepting with a JWT for a user record deleted/deactivated between token issuance and the accept call; partially provisioned auth users (Supabase auth row exists, application User row missing).

Common situations: User account deleted while an invitation email was in flight; test environments with reset databases but reused tokens; sign-up flow interrupted before the User row was created.

Related errors

• The ChatGPT verification link is invalid. Close this window
• No files could be downloaded.
• User not found.
• url must point at a trusted frontend origin.
• Teams not found in this organization: {invalid}

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/1ec0ff318185220b. Report an issue: GitHub.