{"record":{"id":"76adc0ecc736cb51","repo":"Significant-Gravitas/AutoGPT","slug":"application-not-found-or-you-don-t-have-permission","errorCode":null,"errorMessage":"Application not found or you don't have permission to update it","messagePattern":"Application not found or you don't have permission to update it","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"autogpt_platform/backend/backend/api/features/oauth.py","lineNumber":596,"sourceCode":"    is_active: bool = Body(description=\"Whether the app should be active\", embed=True),\n) -> OAuthApplicationInfo:\n    \"\"\"\n    Enable or disable an OAuth application.\n\n    Only the application owner can update the status.\n    When disabled, the application cannot be used for new authorizations\n    and existing access tokens will fail validation.\n\n    Returns the updated application info.\n    \"\"\"\n    updated_app = await update_oauth_application(\n        app_id=app_id,\n        owner_id=user_id,\n        is_active=is_active,\n    )\n\n    if not updated_app:\n        raise HTTPException(\n            status_code=status.HTTP_404_NOT_FOUND,\n            detail=\"Application not found or you don't have permission to update it\",\n        )\n\n    action = \"enabled\" if is_active else \"disabled\"\n    logger.info(f\"OAuth app {updated_app.name} (#{app_id}) {action} by user #{user_id}\")\n\n    return updated_app\n\n\nclass UpdateAppLogoRequest(BaseModel):\n    logo_url: str = Field(description=\"URL of the uploaded logo image\")\n\n\n@router.patch(\"/apps/{app_id}/logo\")\nasync def update_app_logo(\n    app_id: str,\n    request: UpdateAppLogoRequest = Body(),","sourceCodeStart":578,"sourceCodeEnd":614,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/oauth.py#L578-L614","documentation":"Returned (404) when update_oauth_application finds no application row matching both the given app_id and owner_id while enabling/disabling an OAuth app. The lookup is scoped by owner, so both a non-existent app and an app owned by another user produce this response.","triggerScenarios":"PATCH/POST enable-disable with a wrong app_id, an app deleted by its owner, or a valid app_id owned by a different user (or the calling user's auth token identifies a different user id).","commonSituations":"Stale app_id stored client-side after the app was deleted; testing with an account that is not the app owner; user id mismatch after re-authentication or token issued to another account.","solutions":["List your OAuth apps (GET apps endpoint) and use the exact id of an app you own","Confirm the authenticated user is the owner of the app_id in the request","If the app was deleted, recreate it and update stored references"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"apps = await list_my_oauth_apps()\nowned = {a.id for a in apps if a.owner_id == current_user_id}\nassert app_id in owned, f\"app {app_id} not owned by current user\"","typeGuard":"def can_manage_app(app: OAuthAppInfo, user_id: str) -> bool:\n    return app.owner_id == user_id and app.is_active is not None","tryCatchPattern":"if resp.status_code == 404:\n    # app missing OR not owned — refresh app list before retrying\n    apps = list_my_apps(); assert app_id in {a.id for a in apps}","preventionTips":["Drive UI app selectors from the live API list, not cached ids","Clear stored app ids from client state when a delete succeeds","Scope all management calls through the owner's session"],"tags":["oauth","http-404","authorization","api"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}