{"record":{"id":"3411b967752ff896","repo":"Significant-Gravitas/AutoGPT","slug":"api-key-not-found","errorCode":null,"errorMessage":"API key not found","messagePattern":"API key not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"autogpt_platform/backend/backend/api/features/v1.py","lineNumber":2849,"sourceCode":"\n\n@v1_router.get(\n    \"/api-keys/{key_id}\",\n    summary=\"Get specific API key\",\n    tags=[\"api-keys\"],\n    dependencies=[Security(requires_user)],\n)\nasync def get_api_key(\n    key_id: str,\n    user_id: Annotated[str, Security(get_user_id)],\n    ctx: Annotated[RequestContext, Security(get_request_context)],\n) -> api_key_db.APIKeyInfo:\n    \"\"\"Get a specific API key\"\"\"\n    api_key = await api_key_db.get_api_key_by_id(\n        key_id, user_id, organization_id=ctx.org_id or None\n    )\n    if not api_key:\n        raise HTTPException(status_code=404, detail=\"API key not found\")\n    return api_key\n\n\n@v1_router.delete(\n    \"/api-keys/{key_id}\",\n    summary=\"Revoke API key\",\n    tags=[\"api-keys\"],\n    dependencies=[Security(requires_user)],\n)\nasync def delete_api_key(\n    key_id: str,\n    user_id: Annotated[str, Security(get_user_id)],\n    ctx: Annotated[RequestContext, Security(get_request_context)],\n) -> api_key_db.APIKeyInfo:\n    \"\"\"Revoke an API key\"\"\"\n    return await api_key_db.revoke_api_key(\n        key_id, user_id, organization_id=ctx.org_id or None\n    )","sourceCodeStart":2831,"sourceCodeEnd":2867,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/v1.py#L2831-L2867","documentation":"API-key endpoint returns 404 when `api_key_db.get_api_key_by_id(key_id, user_id, organization_id=ctx.org_id or None)` finds nothing: the lookup is scoped by user and (when the request context carries one) organization, so a key ID that exists under a different user/org pairing — or not at all — yields this 404.","triggerScenarios":"GET /api-keys/{key_id} with a revoked/deleted key ID, a key created under a different organization than the request's active org, or a key owned by another user.","commonSituations":"Viewing a key detail after revoking it elsewhere; switching organization context in the UI while holding a key_id from the previous org; stale bookmarks/fetches referencing keys purged after revocation.","solutions":["Re-list keys (GET /api-keys) and confirm key_id is present for the current user + organization.","If the org context changed, re-issue the request under the organization the key was created in.","Drop cached key details after revocation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const keys = await api.listApiKeys();\nconst key = keys.find(k => k.id === keyId && k.orgId === activeOrgId);\nif (!key) { await refreshKeys(); return; }","typeGuard":"function isKeyInScope(k: APIKeyInfo | undefined, userId: string, orgId?: string | null): boolean {\n  return !!k && k.userId === userId && (!orgId || k.orgId === orgId);\n}","tryCatchPattern":"try {\n  return await api.getApiKey(keyId);\n} catch (e) {\n  if (e.status === 404) { await refreshKeys(); return null; }\n  throw e;\n}","preventionTips":["Fetch key details from the current list rather than cached IDs.","Re-issue requests with the correct organization context after switching orgs.","Drop references to keys immediately after revoking them."],"tags":["http-404","api-keys","organization-scoping","ownership"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}