{"record":{"id":"30197325908024c5","repo":"bitwarden/server","slug":"you-must-be-authenticated-to-create-a-request-of-t","errorCode":null,"errorMessage":"You must be authenticated to create a request of that type.","messagePattern":"You must be authenticated to create a request of that type\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Auth/Controllers/AuthRequestsController.cs","lineNumber":84,"sourceCode":"    public async Task<AuthRequestResponseModel> GetResponse(Guid id, [FromQuery] string code)\n    {\n        var authRequest = await _authRequestService.GetValidatedAuthRequestAsync(id, code);\n\n        if (authRequest == null)\n        {\n            throw new NotFoundException();\n        }\n\n        return new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);\n    }\n\n    [HttpPost(\"\")]\n    [AllowAnonymous]\n    public async Task<AuthRequestResponseModel> Post([FromBody] AuthRequestCreateRequestModel model)\n    {\n        if (model.Type == AuthRequestType.AdminApproval)\n        {\n            throw new BadRequestException(\"You must be authenticated to create a request of that type.\");\n        }\n        var authRequest = await _authRequestService.CreateAuthRequestAsync(model);\n        var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);\n        return r;\n    }\n\n    [HttpPost(\"admin-request\")]\n    public async Task<AuthRequestResponseModel> PostAdminRequest([FromBody] AuthRequestCreateRequestModel model)\n    {\n        if (model.Type != AuthRequestType.AdminApproval)\n        {\n            throw new BadRequestException(\"Invalid AuthRequestType. Expected AdminApproval.\");\n        }\n\n        var authRequest = await _authRequestService.CreateAuthRequestAsync(model);\n        var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);\n        return r;\n    }","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Auth/Controllers/AuthRequestsController.cs#L66-L102","documentation":"Thrown as BadRequestException with a custom message (HTTP 400) from POST /auth-requests (AllowAnonymous). When model.Type equals AuthRequestType.AdminApproval, the controller blocks the request because admin-approval auth requests must be created through the authenticated POST /auth-requests/admin-request endpoint. Anonymous creation of this type is not permitted.","triggerScenarios":"An unauthenticated client sends POST /auth-requests with Type set to AdminApproval. This endpoint is [AllowAnonymous], so the request reaches the controller, but the type check immediately rejects it.","commonSituations":"Client incorrectly sends AdminApproval type to the anonymous endpoint instead of the admin-request endpoint. A library or SDK default sets Type to AdminApproval. Developer misunderstanding of which endpoint to call for admin approval requests.","solutions":["For AdminApproval requests, use POST /auth-requests/admin-request with an authenticated token instead of POST /auth-requests.","For standard (non-admin) auth requests, set Type to a non-AdminApproval value (e.g., Unlock, Login) when calling the anonymous endpoint.","Review the AuthRequestType enum to select the correct type for your use case."],"exampleFix":"// before: wrong endpoint for admin approval\nvar resp = await client.PostAsJsonAsync(\"/auth-requests\",\n    new AuthRequestCreateRequestModel { Type = AuthRequestType.AdminApproval, ... }); // 400\n\n// after: use the authenticated admin-request endpoint\nclient.DefaultRequestHeaders.Authorization = new(\"Bearer\", token);\nvar resp = await client.PostAsJsonAsync(\"/auth-requests/admin-request\",\n    new AuthRequestCreateRequestModel { Type = AuthRequestType.AdminApproval, ... });","handlingStrategy":"validation","validationCode":"// Validate the auth request type before sending to the anonymous endpoint\nif (model.Type == AuthRequestType.AdminApproval) {\n    // Redirect to the authenticated admin-request endpoint\n    return Error(\"AdminApproval requests require authentication. Use POST /auth-requests/admin-request.\");\n}\n// Proceed with anonymous creation for non-admin types\nawait client.PostAsJsonAsync(\"/auth-requests\", model);","typeGuard":"static bool IsAnonymousAllowedType(AuthRequestType type) =>\n    type != AuthRequestType.AdminApproval;","tryCatchPattern":"try {\n    var resp = await client.PostAsJsonAsync(\"/auth-requests\", model);\n    resp.EnsureSuccessStatusCode();\n} catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest) {\n    if (model.Type == AuthRequestType.AdminApproval) {\n        // Switch to the authenticated admin-request endpoint\n        await EnsureAuthenticatedAsync();\n        resp = await client.PostAsJsonAsync(\"/auth-requests/admin-request\", model);\n    }\n}","preventionTips":["Client-side, validate that Type is not AdminApproval before calling the anonymous endpoint.","For AdminApproval requests, always use POST /auth-requests/admin-request with a valid token.","Document the endpoint-type mapping clearly in your SDK."],"tags":["auth-request","admin-approval","bad-request","authorization","validation"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}