{"record":{"id":"c91fd92030756391","repo":"bitwarden/server","slug":"user-not-found-c91fd9","errorCode":null,"errorMessage":"User not found.","messagePattern":"User not found\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Vault/Controllers/SyncController.cs","lineNumber":96,"sourceCode":"        _providerUserRepository = providerUserRepository;\n        _policyRepository = policyRepository;\n        _sendRepository = sendRepository;\n        _globalSettings = globalSettings;\n        _currentContext = currentContext;\n        _featureService = featureService;\n        _organizationAbilityCacheService = organizationAbilityCacheService;\n        _twoFactorIsEnabledQuery = twoFactorIsEnabledQuery;\n        _webAuthnCredentialRepository = webAuthnCredentialRepository;\n        _userAccountKeysQuery = userAccountKeysQuery;\n    }\n\n    [HttpGet(\"\")]\n    public async Task<SyncResponseModel> Get([FromQuery] bool excludeDomains = false)\n    {\n        var user = await _userService.GetUserByPrincipalAsync(User);\n        if (user == null)\n        {\n            throw new BadRequestException(\"User not found.\");\n        }\n\n        var organizationUserDetails = await _organizationUserRepository.GetManyDetailsByUserAsync(user.Id,\n            OrganizationUserStatusType.Confirmed);\n        var providerUserDetails = await _providerUserRepository.GetManyDetailsByUserAsync(user.Id,\n            ProviderUserStatusType.Confirmed);\n        var providerUserOrganizationDetails =\n            await _providerUserRepository.GetManyOrganizationDetailsByUserAsync(user.Id,\n                ProviderUserStatusType.Confirmed);\n        var hasEnabledOrgs = organizationUserDetails.Any(o => o.Enabled);\n\n        var folders = await _folderRepository.GetManyByUserIdAsync(user.Id);\n        var allCiphers = await _cipherRepository.GetManyByUserIdAsync(user.Id, withOrganizations: hasEnabledOrgs);\n        var ciphers = FilterUnsupportedCipherTypes(allCiphers);\n        var sends = await _sendRepository.GetManyByUserIdAsync(user.Id);\n\n        IEnumerable<CollectionDetails> collections = null;\n        IDictionary<Guid, IGrouping<Guid, CollectionCipher>> collectionCiphersGroupDict = null;","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Vault/Controllers/SyncController.cs#L78-L114","documentation":"Thrown by SyncController.Get (GET /sync) when _userService.GetUserByPrincipalAsync(User) returns null. This is an authenticated endpoint — the principal (claims from the JWT/access token) resolved to no user in the database. Notably this throws BadRequestException (HTTP 400), not NotFoundException, distinguishing it from resource-missing errors. It indicates the authentication token is valid enough to reach the endpoint but the user record is gone.","triggerScenarios":"User account was deleted or deactivated while the session was still active; database replication lag on multi-region deployments means the user record isn't visible yet; stale access token after account deletion; the user record exists in a different database shard.","commonSituations":"Admin deleted/deactivated the user account while they had an active session; multi-region setup with replication delay; user was migrated to a different shard; auth token was issued before the user was fully provisioned.","solutions":["Have the user log out and back in to obtain a fresh authentication token","Verify the user account still exists and is active in the database","Check for recent account deletion or deactivation events","On multi-region deployments, check for replication delays or shard routing issues"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try\n{\n    var syncResponse = await api.GetSyncAsync();\n}\ncatch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest)\n{\n    var body = await ex.Response?.Content?.ReadAsStringAsync();\n    if (body == \"User not found.\")\n    {\n        // Session is stale — user account may have been deleted/deactivated\n        // Force re-authentication\n        await authService.LogoutAsync();\n        NavigateToLogin();\n    }\n    throw;\n}","preventionTips":["Implement automatic re-authentication when sync returns 'User not found'","Monitor for account deletion or deactivation events that invalidate active sessions","On multi-region deployments, verify database replication health","Avoid caching sync responses — always fetch fresh on app launch"],"tags":["sync","authentication","user-not-found","session","race-condition","multi-region"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}