{"record":{"id":"a7885b14ba469b3b","repo":"bitwarden/server","slug":"unauthorized-a7885b","errorCode":null,"errorMessage":"Unauthorized.","messagePattern":"Unauthorized\\.","errorType":"http","errorClass":"UnauthorizedAccessException","httpStatus":401,"severity":"error","filePath":"src/Api/AdminConsole/Controllers/OrganizationAuthRequestsController.cs","lineNumber":88,"sourceCode":"        {\n            await _authRequestService.UpdateAuthRequestAsync(authRequest.Id, authRequest.UserId,\n                new AuthRequestUpdateRequestModel { RequestApproved = false, });\n        }\n    }\n\n    [HttpPost(\"\")]\n    public async Task UpdateManyAuthRequests(Guid orgId, [FromBody] IEnumerable<OrganizationAuthRequestUpdateManyRequestModel> model)\n    {\n        await ValidateAdminRequest(orgId);\n        await _updateOrganizationAuthRequestCommand.UpdateAsync(orgId, model.Select(x => x.ToOrganizationAuthRequestUpdate()));\n    }\n\n    [NonAction]\n    public async Task ValidateAdminRequest(Guid orgId)\n    {\n        if (!await _currentContext.ManageResetPassword(orgId))\n        {\n            throw new UnauthorizedAccessException();\n        }\n    }\n}\n\n","sourceCodeStart":70,"sourceCodeEnd":93,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Controllers/OrganizationAuthRequestsController.cs#L70-L93","documentation":"Thrown by ValidateAdminRequest (a [NonAction] helper on OrganizationAuthRequestsController) as an UnauthorizedAccessException mapped to HTTP 401 'Unauthorized.' when the current context lacks ManageResetPassword for the org. It is invoked by UpdateAuthRequest, BulkDenyRequests, and UpdateManyAuthRequests, so any admin auth-request action requires the manage-reset-password permission.","triggerScenarios":"POSTing to any org auth-request admin endpoint (approve/deny/bulk-deny/bulk-update) as a user whose role does not grant ManageResetPassword for that organization — e.g. a custom admin, a regular manager, or a provider user without reset-password rights.","commonSituations":"Custom admin role created without the 'Manage reset password' permission; org where password reset is disabled; provider/managed-service user lacking the delegated right; integration using a standard admin token instead of a reset-password-capable one.","solutions":["Grant the caller (or the API token's user) the ManageResetPassword permission for the org.","Ensure organization-level password reset / key connector is enabled before calling these endpoints.","Use an Owner/Admin with reset-password rights for admin auth-request automation.","On 401, surface a permission prompt rather than retrying — credentials alone will not fix it."],"exampleFix":"// before\nawait api.post(`/organizations/${orgId}/auth-requests/${requestId}`, body);\n\n// after\nif (!await hasManageResetPassword(orgId)) {\n  throw new PermissionError('Manage reset password permission required');\n}\nawait api.post(`/organizations/${orgId}/auth-requests/${requestId}`, body);","handlingStrategy":"validation","validationCode":"// Confirm ManageResetPassword for the org before any admin auth-request action\nif (!await currentContext.HasManageResetPasswordAsync(orgId))\n    throw new PermissionException(\"Manage reset password permission required\");\nawait api.PostAsync($\"/organizations/{orgId}/auth-requests/{requestId}\", body);","typeGuard":"static bool HasResetPermission(OrgAbilities a, Guid orgId)\n    => a?.For(orgId)?.ManageResetPassword == true;","tryCatchPattern":"try { await api.PostAsync($\"/auth-requests/{requestId}\", body); }\ncatch (ApiException e) when (e.StatusCode == HttpStatusCode.Unauthorized)\n{ // permission gap, not credentials — prompt for elevation\n  throw new PermissionException(\"Manage reset password required for org\", e); }","preventionTips":["Grant ManageResetPassword to any role/service token used for admin auth-requests.","Ensure org-level password reset / key connector is enabled.","On 401 here, request permission elevation rather than re-authenticating."],"tags":["bitwarden","api","http-401","authorization","auth-requests","reset-password"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}