{"record":{"id":"1f93f8ad319e1028","repo":"bitwarden/server","slug":"invalid-authrequesttype-expected-adminapproval","errorCode":null,"errorMessage":"Invalid AuthRequestType. Expected AdminApproval.","messagePattern":"Invalid AuthRequestType\\. Expected AdminApproval\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Auth/Controllers/AuthRequestsController.cs","lineNumber":96,"sourceCode":"    [HttpPost(\"\")]\n    [AllowAnonymous]\n    public async Task<AuthRequestResponseModel> Post([FromBody] AuthRequestCreateRequestModel model)\n    {\n        if (model.Type == AuthRequestType.AdminApproval)\n        {\n            throw new BadRequestException(\"You must be authenticated to create a request of that type.\");\n        }\n        var authRequest = await _authRequestService.CreateAuthRequestAsync(model);\n        var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);\n        return r;\n    }\n\n    [HttpPost(\"admin-request\")]\n    public async Task<AuthRequestResponseModel> PostAdminRequest([FromBody] AuthRequestCreateRequestModel model)\n    {\n        if (model.Type != AuthRequestType.AdminApproval)\n        {\n            throw new BadRequestException(\"Invalid AuthRequestType. Expected AdminApproval.\");\n        }\n\n        var authRequest = await _authRequestService.CreateAuthRequestAsync(model);\n        var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);\n        return r;\n    }\n\n    [HttpPut(\"{id}\")]\n    public async Task<AuthRequestResponseModel> Put(Guid id, [FromBody] AuthRequestUpdateRequestModel model)\n    {\n        var userId = _userService.GetProperUserId(User).Value;\n\n        // If the Approving Device is attempting to approve a request, validate the approval\n        if (model.RequestApproved == true)\n        {\n            await ValidateApprovalOfMostRecentAuthRequest(id, userId);\n        }\n","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Auth/Controllers/AuthRequestsController.cs#L78-L114","documentation":"Thrown as BadRequestException with a custom message (HTTP 400) from POST /auth-requests/admin-request. When model.Type is NOT AuthRequestType.AdminApproval, the controller rejects it. The admin-request endpoint exclusively handles AdminApproval-type auth requests; any other type is a client error.","triggerScenarios":"An authenticated client calls POST /auth-requests/admin-request with a Type other than AdminApproval (e.g., Login, Unlock). The endpoint validates that the type matches its exclusive purpose.","commonSituations":"Client sends the wrong AuthRequestType to the admin-request endpoint. Copy-paste error where a standard auth request model is reused for an admin request. SDK or wrapper library defaults the Type field to a non-AdminApproval value.","solutions":["Set Type to AuthRequestType.AdminApproval when calling POST /auth-requests/admin-request.","For other auth request types (Login, Unlock), use POST /auth-requests instead.","Validate the Type field client-side before sending."],"exampleFix":"// before: wrong type for admin-request endpoint\nvar resp = await client.PostAsJsonAsync(\"/auth-requests/admin-request\",\n    new AuthRequestCreateRequestModel { Type = AuthRequestType.Login, ... }); // 400\n\n// after: use correct type\nvar resp = await client.PostAsJsonAsync(\"/auth-requests/admin-request\",\n    new AuthRequestCreateRequestModel { Type = AuthRequestType.AdminApproval, ... });","handlingStrategy":"validation","validationCode":"// Validate the type before calling the admin-request endpoint\nif (model.Type != AuthRequestType.AdminApproval) {\n    return Error(\"POST /auth-requests/admin-request only accepts AdminApproval type. Use POST /auth-requests for other types.\");\n}\nawait client.PostAsJsonAsync(\"/auth-requests/admin-request\", model);","typeGuard":"static bool IsValidForAdminEndpoint(AuthRequestType type) =>\n    type == AuthRequestType.AdminApproval;","tryCatchPattern":"try {\n    var resp = await client.PostAsJsonAsync(\"/auth-requests/admin-request\", model);\n    resp.EnsureSuccessStatusCode();\n} catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest) {\n    if (model.Type != AuthRequestType.AdminApproval) {\n        // Route to the correct endpoint for this type\n        resp = await client.PostAsJsonAsync(\"/auth-requests\", model);\n    }\n}","preventionTips":["Always set Type to AdminApproval when calling the admin-request endpoint.","For other auth request types, use the standard POST /auth-requests endpoint.","Validate the type field client-side before dispatching to the correct endpoint."],"tags":["auth-request","admin-approval","bad-request","validation","type-mismatch"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}