{"record":{"id":"b31464e3df602e8b","repo":"zaproxy/zaproxy","slug":"user-not-found-b31464","errorCode":"USER_NOT_FOUND","errorMessage":"USER_NOT_FOUND: PARAM_USER_ID","messagePattern":"USER_NOT_FOUND: PARAM_USER_ID","errorType":"error_code","errorClass":"ApiException","httpStatus":null,"severity":"error","filePath":"zap/src/main/java/org/zaproxy/zap/authentication/UsernamePasswordAuthenticationCredentials.java","lineNumber":319,"sourceCode":"                if (!methodType.isTypeForMethod(context.getAuthenticationMethod()))\n                    throw new ApiException(\n                            ApiException.Type.ILLEGAL_PARAMETER,\n                            \"User's credentials should match authentication method type of the context: \"\n                                    + context.getAuthenticationMethod().getType().getName());\n\n                // NOTE: no need to check if extension is loaded as this method is called only if\n                // the Users\n                // extension is loaded\n                ExtensionUserManagement extensionUserManagement =\n                        Control.getSingleton()\n                                .getExtensionLoader()\n                                .getExtension(ExtensionUserManagement.class);\n                User user =\n                        extensionUserManagement\n                                .getContextUserAuthManager(context.getId())\n                                .getUserById(userId);\n                if (user == null)\n                    throw new ApiException(\n                            ApiException.Type.USER_NOT_FOUND, UsersAPI.PARAM_USER_ID);\n                // Build and set the credentials\n                UsernamePasswordAuthenticationCredentials credentials =\n                        (UsernamePasswordAuthenticationCredentials)\n                                context.getAuthenticationMethod().createAuthenticationCredentials();\n                credentials.username = ApiUtils.getNonEmptyStringParam(params, PARAM_USERNAME);\n                credentials.password = params.optString(PARAM_PASSWORD, \"\");\n                credentials.readTotpData(params);\n\n                user.setAuthenticationCredentials(credentials);\n            }\n        };\n    }\n}\n","sourceCodeStart":301,"sourceCodeEnd":334,"githubUrl":"https://github.com/zaproxy/zaproxy/blob/9d1970a436b1b189bfb588fc88864c80d9baf6a5/zap/src/main/java/org/zaproxy/zap/authentication/UsernamePasswordAuthenticationCredentials.java#L301-L334","documentation":"Users API action could not find a user with the given userId in the context's user manager, so a USER_NOT_FOUND ApiException is thrown with the parameter name PARAM_USER_ID. getUserById returned null for the supplied id.","triggerScenarios":"Calling users API actions (e.g. setAuthenticationCredentials) with a userId that does not exist under the given contextId — user was never created, was deleted, or belongs to a different context.","commonSituations":"Hardcoded userId in CI scripts after re-creating contexts; users created in a different context than the one referenced; ZAP session reset between runs losing previously created users; off-by-one using 0-based vs 1-based ids.","solutions":["Create the user first via users/newUser for the target context and use the returned userId","List existing users with /JSON/users/view/users/ for the given contextId to get valid ids","Verify the contextId matches the context the user was created in","Persist/restore the ZAP session (or re-run user setup) if users disappear between runs"],"exampleFix":"// before\napi.call(\"users/action/setAuthenticationCredentials\", {contextId:1, userId:3, ...});\n// after\nconst userId = api.call(\"users/action/newUser\", {contextId:1, name:\"ci-user\"}).userId;\napi.call(\"users/action/setAuthenticationCredentials\", {contextId:1, userId, ...});","handlingStrategy":"validation","validationCode":"JSONArray users = api.call(\"/JSON/users/view/users/\", Map.of(\"contextId\", contextId))\n    .getJSONArray(\"users\");\nboolean exists = IntStream.range(0, users.length())\n    .anyMatch(i -> users.getJSONObject(i).getInt(\"id\") == userId);\nif (!exists) throw new IllegalArgumentException(\"No user \" + userId + \" in context \" + contextId);","typeGuard":null,"tryCatchPattern":"try { ... } catch (ApiException e) { if (e.getType() == ApiException.Type.USER_NOT_FOUND) { String newId = api.call(\"/JSON/users/action/newUser\", Map.of(\"contextId\", contextId, \"name\", userName)); retrySetCredentials(newId); } throw e; }","preventionTips":["Create users programmatically and capture the returned ids instead of hardcoding","Scope user lookups to the correct contextId","Re-run user setup after any session/context reset in CI"],"tags":["api","users","not-found","zap"],"backgroundTag":"entity-not-found","analyzedSha":"9d1970a436b1b189bfb588fc88864c80d9baf6a5","analyzedAt":"2026-09-05T19:26:59.356Z","contentChangedAt":"2026-09-05T19:26:59.356Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}