{"record":{"id":"7f5920410764b555","repo":"bitwarden/server","slug":"no-version-ids-provided","errorCode":null,"errorMessage":"No version IDs provided.","messagePattern":"No version IDs provided\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"src/Api/SecretsManager/Controllers/SecretVersionsController.cs","lineNumber":107,"sourceCode":"\n        var orgAdmin = await _currentContext.OrganizationAdmin(secret.OrganizationId);\n        var accessClient = AccessClientHelper.ToAccessClient(_currentContext.IdentityClientType, orgAdmin);\n\n        var access = await _secretRepository.AccessToSecretAsync(secretVersion.SecretId, userId.Value, accessClient);\n        if (!access.Read)\n        {\n            throw new NotFoundException();\n        }\n\n        return new SecretVersionResponseModel(secretVersion);\n    }\n\n    [HttpPost(\"secret-versions/get-by-ids\")]\n    public async Task<ListResponseModel<SecretVersionResponseModel>> GetManyByIdsAsync([FromBody] List<Guid> ids)\n    {\n        if (!ids.Any())\n        {\n            throw new BadRequestException(\"No version IDs provided.\");\n        }\n\n        // Get all versions\n        var versions = (await _secretVersionRepository.GetManyByIdsAsync(ids)).ToList();\n        if (!versions.Any())\n        {\n            throw new NotFoundException();\n        }\n\n        // Get all associated secrets and check permissions\n        var secretIds = versions.Select(v => v.SecretId).Distinct().ToList();\n        var secrets = (await _secretRepository.GetManyByIds(secretIds)).ToList();\n\n        if (!secrets.Any())\n        {\n            throw new NotFoundException();\n        }\n","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/SecretsManager/Controllers/SecretVersionsController.cs#L89-L125","documentation":"Thrown by SecretVersionsController.GetManyByIdsAsync (and the parallel BulkDelete path) when the request body list of ids is empty. BadRequestException maps to HTTP 400 with message \"No version IDs provided.\"","triggerScenarios":"POST /secret-versions/get-by-ids with an empty JSON array body ([]), or a null body deserialized to an empty list.","commonSituations":"Client submitted the request before populating ids; upstream filter produced zero ids; default/empty collection serialized.","solutions":["Ensure the body array is non-empty before posting.","Guard the call site: skip the request when ids.Count == 0.","Validate the upstream selection that populates ids."],"exampleFix":"// before\nawait client.PostAsync(\"/secret-versions/get-by-ids\", ids);\n// after\nif (ids is null || ids.Count == 0) return;\nawait client.PostAsync(\"/secret-versions/get-by-ids\", ids);","handlingStrategy":"validation","validationCode":"if (ids is null || ids.Count == 0) throw new ArgumentException(\"ids must be a non-empty list.\");\nawait client.PostAsync(\"/secret-versions/get-by-ids\", ids);","typeGuard":"static bool HasVersionIds(IReadOnlyCollection<Guid> ids) => ids is { Count: > 0 };","tryCatchPattern":null,"preventionTips":["Short-circuit callers when the id collection is empty.","Validate list inputs at the controller boundary.","Wire upstream selectors to never produce empty payloads."],"tags":["bitwarden","secrets-manager","validation","http-400","bad-request","empty-input"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}