{"record":{"id":"549a5350a961fadd","repo":"bitwarden/server","slug":"resource-not-found-549a53","errorCode":null,"errorMessage":"Resource not found.","messagePattern":"Resource not found\\.","errorType":"http","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"src/Api/Auth/Controllers/AuthRequestsController.cs","lineNumber":49,"sourceCode":"\n    [HttpGet(\"\")]\n    public async Task<ListResponseModel<AuthRequestResponseModel>> GetAll()\n    {\n        var userId = _userService.GetProperUserId(User).Value;\n        var authRequests = await _authRequestRepository.GetManyByUserIdAsync(userId);\n        var responses = authRequests.Select(a => new AuthRequestResponseModel(a, _globalSettings.BaseServiceUri.Vault));\n        return new ListResponseModel<AuthRequestResponseModel>(responses);\n    }\n\n    [HttpGet(\"{id}\")]\n    public async Task<AuthRequestResponseModel> Get(Guid id)\n    {\n        var userId = _userService.GetProperUserId(User).Value;\n        var authRequest = await _authRequestService.GetAuthRequestAsync(id, userId);\n\n        if (authRequest == null)\n        {\n            throw new NotFoundException();\n        }\n\n        return new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);\n    }\n\n    [HttpGet(\"pending\")]\n    public async Task<ListResponseModel<PendingAuthRequestResponseModel>> GetPendingAuthRequestsAsync()\n    {\n        var userId = _userService.GetProperUserId(User).Value;\n        var rawResponse = await _authRequestRepository.GetManyPendingAuthRequestByUserId(userId);\n        var responses = rawResponse.Select(a => new PendingAuthRequestResponseModel(a, _globalSettings.BaseServiceUri.Vault));\n        return new ListResponseModel<PendingAuthRequestResponseModel>(responses);\n    }\n\n    [HttpGet(\"{id}/response\")]\n    [AllowAnonymous]\n    public async Task<AuthRequestResponseModel> GetResponse(Guid id, [FromQuery] string code)\n    {","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Auth/Controllers/AuthRequestsController.cs#L31-L67","documentation":"Thrown as NotFoundException (HTTP 404) from GET /auth-requests/{id}. _authRequestService.GetAuthRequestAsync(id, userId) returns null — no auth request exists with the given id that belongs to the requesting user. The controller requires both the correct id and ownership (userId match).","triggerScenarios":"GET /auth-requests/{id} is called with a GUID that does not exist or belongs to a different user. The auth request may have been deleted, expired, or was never created.","commonSituations":"Client uses a stale auth request ID from a previous session. The auth request was already consumed or expired and cleaned up. User A tries to access an auth request belonging to user B (ownership enforcement). The ID was transcribed or copy-pasted incorrectly.","solutions":["Call GET /auth-requests to list the user's current auth requests and use a valid ID from the result.","If the request was for device login, initiate a new auth request via POST /auth-requests.","Verify the GUID is correctly formatted and belongs to the authenticated user."],"exampleFix":"// before: using a stale ID\nvar resp = await client.GetAsync($\"/auth-requests/{oldRequestId}\"); // 404\n\n// after: fetch current list first\nvar list = await client.GetAsync(\"/auth-requests\");\nvar currentId = ParseLatestRequestId(list);\nvar resp = await client.GetAsync($\"/auth-requests/{currentId}\");","handlingStrategy":"validation","validationCode":"// Verify the auth request ID exists in the user's list before fetching\nvar list = await client.GetAsync(\"/auth-requests\");\nvar validIds = ParseAuthRequestIds(list);\nif (!validIds.Contains(requestedId)) {\n    return Error(\"Auth request not found. It may have expired or been deleted.\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    var resp = await client.GetAsync($\"/auth-requests/{id}\");\n    resp.EnsureSuccessStatusCode();\n} catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.NotFound) {\n    // Auth request doesn't exist or belongs to another user\n    // Refresh the pending list or create a new auth request\n    await RefreshAuthRequestListAsync();\n}","preventionTips":["Cache the list of auth request IDs after creating or listing them, and only fetch by IDs from that list.","Handle 404 gracefully by refreshing the list or prompting the user to create a new request.","Avoid hardcoding or persisting auth request IDs across sessions."],"tags":["auth-request","not-found","device-login","ownership"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}