{"record":{"id":"40410b5dbc6fb7de","repo":"bitwarden/server","slug":"user-verification-failed-40410b","errorCode":null,"errorMessage":"User verification failed.","messagePattern":"User verification failed\\.","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Vault/Controllers/CiphersController.cs","lineNumber":1294,"sourceCode":"    public async Task<ListResponseModel<CipherMiniResponseModel>> PostShareMany([FromBody] CipherBulkShareRequestModel model)\n    {\n        return await PutShareMany(model);\n    }\n\n    [HttpPost(\"purge\")]\n    public async Task PostPurge([FromBody] SecretVerificationRequestModel model, Guid? organizationId = null)\n    {\n        var user = await _userService.GetUserByPrincipalAsync(User);\n        if (user == null)\n        {\n            throw new UnauthorizedAccessException();\n        }\n\n        if (!await _userService.VerifySecretAsync(user, model.Secret))\n        {\n            ModelState.AddModelError(string.Empty, \"User verification failed.\");\n            await Task.Delay(2000);\n            throw new BadRequestException(ModelState);\n        }\n\n        if (organizationId == null)\n        {\n            // Check if the user is claimed by any organization.\n            if (await _userService.IsClaimedByAnyOrganizationAsync(user.Id))\n            {\n                throw new BadRequestException(new CannotPurgeClaimedAccountError().Message);\n            }\n            await _cipherRepository.DeleteByUserIdAsync(user.Id);\n        }\n        else\n        {\n            if (!await _currentContext.EditAnyCollection(organizationId!.Value))\n            {\n                throw new NotFoundException();\n            }\n            await _cipherService.PurgeAsync(organizationId!.Value);","sourceCodeStart":1276,"sourceCodeEnd":1312,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Vault/Controllers/CiphersController.cs#L1276-L1312","documentation":"Error \"User verification failed.\" thrown in bitwarden/server.","triggerScenarios":"Thrown when user verification (password or OTP) fails before a sensitive cipher operation such as purge or attachment access.","commonSituations":"See trigger scenarios.","solutions":["Re-enter your master password when prompted to verify your identity, then retry.","Complete any required two-factor verification before retrying the sensitive operation.","Sign out and back in to obtain a fresh session token if the session has expired."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}