{"record":{"id":"1d04a603a635c718","repo":"bitwarden/server","slug":"could-not-locate-send","errorCode":null,"errorMessage":"Could not locate send","messagePattern":"Could not locate send","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Tools/Controllers/SendsController.cs","lineNumber":146,"sourceCode":"        var sends = await _sendOwnerQuery.GetOwned(User);\n        var responses = sends.Select(s => new SendResponseModel(s));\n        var result = new ListResponseModel<SendResponseModel>(responses);\n\n        return result;\n    }\n\n    [Authorize(Policy = Policies.Send)]\n    [HttpPost(\"access/\")]\n    [ProducesResponseType<SendAccessResponseModel>(StatusCodes.Status200OK)]\n    [ProducesResponseType(StatusCodes.Status400BadRequest)]\n    [ProducesResponseType(StatusCodes.Status404NotFound)]\n    public async Task<IActionResult> AccessUsingAuth()\n    {\n        var guid = User.GetSendId();\n        var send = await _sendRepository.GetByIdAsync(guid);\n        if (send == null)\n        {\n            throw new BadRequestException(\"Could not locate send\");\n        }\n\n        if (!INonAnonymousSendCommand.SendCanBeAccessed(send))\n        {\n            throw new NotFoundException();\n        }\n\n        var sendResponse = new SendAccessResponseModel(send);\n        if (send.UserId.HasValue && !send.HideEmail.GetValueOrDefault())\n        {\n            var creator = await _userService.GetUserByIdAsync(send.UserId.Value);\n            sendResponse.CreatorIdentifier = creator.Email;\n        }\n\n        /*\n         * AccessCount is incremented differently depending on Send type:\n         * - Text and Item Sends are incremented at every access\n         * - File Sends are incremented only when the file is downloaded","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Tools/Controllers/SendsController.cs#L128-L164","documentation":"Thrown as BadRequestException (HTTP 400) from POST /sends/access/ when the Send referenced by the JWT SendId claim cannot be found in the repository. The endpoint requires the 'Send' policy (a valid access token issued for that send), yet the underlying record is gone. A 400 (not 404) is returned because the access token is internally inconsistent with server state.","triggerScenarios":"POST /sends/access/ with a valid Send access token whose SendId points to a Send that was deleted, purged by the deletion-date background job, or never existed (token issued against stale/local data).","commonSituations":"Recipient opened a Send link after the sender deleted it or after it passed its deletion date; client cached an old access token; the Send was removed by an admin; clock skew caused the deletion job to run early.","solutions":["Have the recipient request a new Send / access link from the owner.","Confirm the Send still exists by having the owner check GET /sends/{id}.","Check the deletion date / expiration has not elapsed server-side.","Clear cached client Send tokens and re-authenticate the access flow."],"exampleFix":"// before\nvar send = await _sendRepository.GetByIdAsync(guid);\nif (send == null) throw new BadRequestException(\"Could not locate send\");\n\n// after: surface a clearer access-state error to the client\nif (send == null) throw new NotFoundException(); // 404 'Resource not found.'","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    var resp = await client.PostAsync(\"sends/access/\", accessContent);\n    resp.EnsureSuccessStatusCode();\n} catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest) {\n    // The Send no longer exists; prompt the user to request a new link.\n    ShowUser(\"This Send is no longer available. Please request a new link.\");\n}","preventionTips":["Have recipients re-authenticate access promptly after receiving a link.","Owners: avoid deleting a Send while recipients may still open it.","Clients: clear Send access tokens when the owner reports deletion."],"tags":["send","http-400","access","bitwarden-server","validation"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}