{"record":{"id":"33d0a51993f7d078","repo":"bitwarden/server","slug":"resource-not-found-33d0a5","errorCode":null,"errorMessage":"Resource not found.","messagePattern":"Resource not found\\.","errorType":"http","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"src/Api/SecretsManager/Controllers/SecretVersionsController.cs","lineNumber":263,"sourceCode":"        var secrets = await _secretRepository.GetManyByIds(secretIds);\n        var secretsList = secrets.ToList();\n\n        if (!secretsList.Any())\n        {\n            throw new NotFoundException();\n        }\n\n        var organizationId = secretsList.First().OrganizationId;\n        if (secretsList.Any(s => s.OrganizationId != organizationId) ||\n            !_currentContext.AccessSecretsManager(organizationId))\n        {\n            throw new NotFoundException();\n        }\n\n        var userId = _userService.GetProperUserId(User);\n        if (!userId.HasValue)\n        {\n            throw new NotFoundException();\n        }\n\n        var orgAdmin = await _currentContext.OrganizationAdmin(organizationId);\n        var accessClient = AccessClientHelper.ToAccessClient(_currentContext.IdentityClientType, orgAdmin);\n\n        var accessResults = await _secretRepository.AccessToSecretsAsync(secretIds, userId.Value, accessClient);\n        if (accessResults.Count != secretIds.Count || accessResults.Values.Any(access => !access.Write))\n        {\n            throw new NotFoundException();\n        }\n\n        await _secretVersionRepository.DeleteManyByIdAsync(ids);\n\n        return Ok();\n    }\n}\n","sourceCodeStart":245,"sourceCodeEnd":280,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/SecretsManager/Controllers/SecretVersionsController.cs#L245-L280","documentation":"Thrown by BulkDeleteAsync when GetProperUserId returns no value for the authenticated principal. The caller authenticated past [Authorize(\"secrets\")] but has no resolvable user/service-account id, so per-user access checks cannot run. NotFoundException (body 'Resource not found.') masks the authentication gap.","triggerScenarios":"An authenticated request with a principal that carries no mappable user id (e.g. certain machine/installation tokens) reaches the bulk-delete endpoint.","commonSituations":"A token type without a user id claim is used on a user-scoped endpoint; partially-issued or degraded token; auth pipeline misconfiguration dropping the user claim.","solutions":["Use a token that resolves to a concrete user or service account id.","Re-authenticate to get a token with a valid user id claim.","Verify the auth middleware populates the user id on the principal."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await client.PostAsync(\"secret-versions/delete\", ids); }\ncatch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.NotFound)\n{ /* principal has no resolvable user id; re-authenticate */ }","preventionTips":["Use tokens that resolve to a concrete user or service account id.","Re-authenticate on unexpected 404 for an authenticated user-scoped call.","Confirm the auth middleware populates the user id claim."],"tags":["bitwarden","secrets-manager","identity","authentication","not-found","http-404","aspnet","csharp"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}