{"record":{"id":"33ee9eb3306fef13","repo":"bitwarden/server","slug":"resource-not-found-33ee9e","errorCode":null,"errorMessage":"Resource not found.","messagePattern":"Resource not found\\.","errorType":"http","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"src/Api/SecretsManager/Controllers/SecretsController.cs","lineNumber":83,"sourceCode":"        _createSecretCommand = createSecretCommand;\n        _updateSecretCommand = updateSecretCommand;\n        _deleteSecretCommand = deleteSecretCommand;\n        _accessClientQuery = accessClientQuery;\n        _secretsSyncQuery = secretsSyncQuery;\n        _secretAccessPoliciesUpdatesQuery = secretAccessPoliciesUpdatesQuery;\n        _userService = userService;\n        _eventService = eventService;\n        _authorizationService = authorizationService;\n        _organizationUserRepository = organizationUserRepository;\n\n    }\n\n    [HttpGet(\"organizations/{organizationId}/secrets\")]\n    public async Task<SecretWithProjectsListResponseModel> ListByOrganizationAsync([FromRoute] Guid organizationId)\n    {\n        if (!_currentContext.AccessSecretsManager(organizationId))\n        {\n            throw new NotFoundException();\n        }\n\n        var userId = _userService.GetProperUserId(User).Value;\n        var orgAdmin = await _currentContext.OrganizationAdmin(organizationId);\n        var accessClient = AccessClientHelper.ToAccessClient(_currentContext.IdentityClientType, orgAdmin);\n\n        var secrets = await _secretRepository.GetManyDetailsByOrganizationIdAsync(organizationId, userId, accessClient);\n\n        return new SecretWithProjectsListResponseModel(secrets);\n    }\n\n    [HttpPost(\"organizations/{organizationId}/secrets\")]\n    public async Task<SecretResponseModel> CreateAsync([FromRoute] Guid organizationId,\n        [FromBody] SecretCreateRequestModel createRequest)\n    {\n        var secret = createRequest.ToSecret(organizationId);\n        var authorizationResult = await _authorizationService.AuthorizeAsync(User, secret, SecretOperations.Create);\n        if (!authorizationResult.Succeeded)","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/SecretsManager/Controllers/SecretsController.cs#L65-L101","documentation":"Thrown by SecretsController.ListByOrganizationAsync when ICurrentContext.AccessSecretsManager(organizationId) is false, i.e. the caller has no Secrets Manager access to the route organization. This is the first gate before any data is loaded. NotFoundException (body 'Resource not found.') prevents confirming the organization exists.","triggerScenarios":"GET /organizations/{organizationId}/secrets by a user or service account whose context grants no Secrets Manager access to that organizationId (org has SM disabled, caller is not a member, or no access policy).","commonSituations":"Organization has not enabled/purchased Secrets Manager; user is not a member of the org; service account token scoped to a different org; calling the wrong orgId after an org migration.","solutions":["Confirm the organization has Secrets Manager enabled.","Ensure the caller is a member with a Secrets Manager access policy for the organization.","Check that the route organizationId matches the token's scope."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Locally confirm SM access before listing\nif (!callerCanAccessSecretsManager(orgId)) return;","typeGuard":null,"tryCatchPattern":"try { var secrets = await client.ListSecretsByOrgAsync(orgId); }\ncatch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.NotFound)\n{ /* no SM access for org; prompt for access/enablement, do not retry */ }","preventionTips":["Confirm the organization has Secrets Manager enabled before listing.","Ensure the caller is a member with a Secrets Manager access policy.","Match the route orgId to the token's scoped organization."],"tags":["bitwarden","secrets-manager","access-control","authorization","organization","not-found","http-404","aspnet","csharp","security"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}