{"record":{"id":"3688fabd6d640617","repo":"bitwarden/server","slug":"you-cannot-save-a-send-having-an-invalid-authtype","errorCode":null,"errorMessage":"You cannot save a Send having an invalid AuthType","messagePattern":"You cannot save a Send having an invalid AuthType","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Tools/Models/Request/SendRequestModel.cs","lineNumber":285,"sourceCode":"            existingSend.AuthType = AuthType;\n            switch (AuthType)\n            {\n                case Core.Tools.Enums.AuthType.Email:\n                    var emails = string.IsNullOrWhiteSpace(Emails) ? [] : Emails.Split(',', RemoveEmptyEntries | TrimEntries);\n                    existingSend.Emails = string.Join(\",\", emails);\n                    existingSend.Password = null;\n                    break;\n                case Core.Tools.Enums.AuthType.Password:\n                    existingSend.Password = authorizationService.HashPassword(Password!);\n                    existingSend.Emails = null;\n                    break;\n                case Core.Tools.Enums.AuthType.None:\n                case null:\n                    existingSend.Emails = null;\n                    existingSend.Password = null;\n                    break;\n                default:\n                    throw new BadRequestException(\"You cannot save a Send having an invalid AuthType\");\n            }\n        }\n        /* FIXME: Remove after two releases of clients\n        // This supports clients that do not send an AuthType in the request,\n        // but does not fully support a user changing the AuthType in the UI.\n        // Specifically a password protected Send can't directly change AuthType to None using this logic.\n        // They can change to AuthType.Email, and then AuthType.None.\n        */\n        else\n        {\n            if (!string.IsNullOrWhiteSpace(Emails))\n            {\n                // normalize encoding\n                var emails = Emails.Split(',', RemoveEmptyEntries | TrimEntries);\n                existingSend.Emails = string.Join(\",\", emails);\n                existingSend.Password = null;\n            }\n            else if (!string.IsNullOrWhiteSpace(Password))","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Tools/Models/Request/SendRequestModel.cs#L267-L303","documentation":"On a Send create/update, the server switches on the request's `AuthType` (a nullable byte enum: Email=0, Password=1, None=2). Every named value and null have an explicit arm, so the `default` arm can only fire when `AuthType` is a numeric value outside {0,1,2}. The server cannot decide how to authorize the Send, so it rejects the request with HTTP 400.","triggerScenarios":"A PUT/POST /sends request whose JSON `authType` field is a number outside the defined enum (e.g. 3, 4, 255, or -1), causing the switch to fall through to the `default` throw at SendRequestModel.cs:285.","commonSituations":"A forked/custom client sending a numeric AuthType that doesn't match Core.Tools.Enums.AuthType; a newer client sending a future enum value to an older server that doesn't know it; manual API testing with a typo'd value; an integer cast from an unknown string enum member.","solutions":["Validate that `authType` is one of 0 (Email), 1 (Password), or 2 (None) before sending the request.","Update the client to use the exact enum values defined in Core.Tools.Enums.AuthType.","If extending AuthType with a new member, deploy the server with the new enum before any client sends it."],"exampleFix":"// before\n{ \"type\": 1, \"authType\": 3 }\n// after\n{ \"type\": 1, \"authType\": 2 }  // AuthType.None","handlingStrategy":"validation","validationCode":"const VALID_AUTH_TYPES = new Set([0, 1, 2]); // Email, Password, None\nfunction buildSendPayload(authType, ...rest) {\n  if (!VALID_AUTH_TYPES.has(authType)) {\n    throw new Error(`Invalid authType ${authType}; must be 0, 1, or 2`);\n  }\n  return { ...rest, authType };\n}","typeGuard":"function isValidAuthType(v: unknown): v is 0 | 1 | 2 {\n  return v === 0 || v === 1 || v === 2;\n}","tryCatchPattern":"try { await api.put(`/sends/${id}`, payload); }\ncatch (e) {\n  if (e?.response?.status === 400 && /invalid AuthType/i.test(e.response.data?.message ?? '')) {\n    // fix authType and retry once\n  } else throw e;\n}","preventionTips":["Always validate enum values against the server's known set before sending.","Keep the client's AuthType enum in sync with Core.Tools.Enums.AuthType.","Never cast arbitrary integers into enum fields without range-checking."],"tags":["send","auth-type","enum","validation","bad-request"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}