{"record":{"id":"9fe7e91ba2fd990e","repo":"bitwarden/server","slug":"resource-not-found-9fe7e9","errorCode":null,"errorMessage":"Resource not found.","messagePattern":"Resource not found\\.","errorType":"exception","errorClass":"NotFoundException","httpStatus":404,"severity":"warning","filePath":"src/Api/Dirt/Controllers/EventsController.cs","lineNumber":160,"sourceCode":"        }\n\n        var dateRange = ApiHelpers.GetDateRange(start, end);\n        var result = await _eventRepository.GetManyBySendAsync(orgId, id, dateRange.Item1, dateRange.Item2,\n            new PageOptions { ContinuationToken = continuationToken });\n        var responses = result.Data.Select(e => new EventResponseModel(e));\n        return new ListResponseModel<EventResponseModel>(responses, result.ContinuationToken);\n    }\n\n    [HttpGet(\"~/organization/{orgId}/secrets/{id}/events\")]\n    public async Task<ListResponseModel<EventResponseModel>> GetSecrets(\n        Guid id, Guid orgId,\n        [FromQuery] DateTime? start = null,\n        [FromQuery] DateTime? end = null,\n        [FromQuery] string continuationToken = null)\n    {\n        if (id == Guid.Empty || orgId == Guid.Empty)\n        {\n            throw new NotFoundException();\n        }\n\n        var secret = await _secretRepository.GetByIdAsync(id);\n        var orgIdForVerification = secret?.OrganizationId ?? orgId;\n        var secretOrg = _currentContext.GetOrganization(orgIdForVerification);\n\n        if (secretOrg == null || !await _currentContext.AccessEventLogs(secretOrg.Id))\n        {\n            throw new NotFoundException();\n        }\n\n        bool canViewLogs = false;\n\n        if (secret == null)\n        {\n            secret = new Core.SecretsManager.Entities.Secret { Id = id, OrganizationId = orgId };\n            canViewLogs = secretOrg.Type is Core.Enums.OrganizationUserType.Admin or Core.Enums.OrganizationUserType.Owner;\n        }","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Dirt/Controllers/EventsController.cs#L142-L178","documentation":"Thrown as NotFoundException (HTTP 404) by GET ~/organization/{orgId}/secrets/{id}/events when id or orgId is Guid.Empty. The very first guard rejects empty GUIDs before any data lookup, so the client never sees a difference between a missing resource and a malformed one (intentional 404-not-403 info-leak pattern).","triggerScenarios":"Calling the secret-events endpoint with id=00000000-0000-0000-0000-000000000000 or orgId=Guid.Empty, e.g. client failed to bind a route value and defaulted it.","commonSituations":"Client constructs the URL from an uninitialized/zero GUID; a route parameter missing in the template; integration test using Guid.Empty as a sentinel.","solutions":["Ensure the client resolves a real secret id and org id before building the URL.","Fail fast in the client if either id equals Guid.Empty.","Check the route template is filled completely."],"exampleFix":"// before\n//   GET /organization/00000000-.../secrets/00000000-.../events\n//\n// after\nif (orgId == Guid.Empty || secretId == Guid.Empty) return; // or show 'select a secret'\nawait GetSecretEvents(orgId, secretId);","handlingStrategy":"validation","validationCode":"// Reject empty GUIDs before calling secret events\nif (orgId === EMPTY_GUID || secretId === EMPTY_GUID) {\n  throw new Error('orgId and secretId are required');\n}\nawait getSecretEvents(orgId, secretId);","typeGuard":"function isNonEmptyGuid(g) { return typeof g === 'string' && g !== '00000000-0000-0000-0000-000000000000'; }","tryCatchPattern":null,"preventionTips":["Bind both route values explicitly; never default to Guid.Empty.","Short-circuit in the client when either id is the zero GUID.","In tests, use real (or randomly generated) GUIDs, not Guid.Empty."],"tags":["events","secrets-manager","validation","http-404","guid"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}