{"record":{"id":"dfe7bf2e605ba85d","repo":"instructure/canvas-lms","slug":"couldn-t-find-user-with-api-id-params-student-id","errorCode":null,"errorMessage":"Couldn't find user with API id '#{params[:student_id]}'","messagePattern":"Couldn't find user with API id '#(.+?)'","errorType":"exception","errorClass":"ActiveRecord::RecordNotFound","httpStatus":404,"severity":"error","filePath":"app/controllers/grade_change_audit_api_controller.rb","lineNumber":188,"sourceCode":"\n  # @API Query by student\n  #\n  # List grade change events for a given student.\n  #\n  # @argument start_time [DateTime]\n  #   The beginning of the time range from which you want events.\n  #\n  # @argument end_time [DateTime]\n  #   The end of the time range from which you want events.\n  #\n  # @returns [GradeChangeEvent]\n  #\n  def for_student\n    return render_unauthorized_action unless admin_authorized?\n\n    @student = api_find(User.active, params[:student_id])\n    unless @domain_root_account.associated_user?(@student)\n      raise ActiveRecord::RecordNotFound, \"Couldn't find user with API id '#{params[:student_id]}'\"\n    end\n\n    events = Auditors::GradeChange.for_root_account_student(@domain_root_account, @student, query_options)\n    render_events(events, api_v1_audit_grade_change_student_url(@student), remove_anonymous: true)\n  end\n\n  # @API Query by grader\n  #\n  # List grade change events for a given grader.\n  #\n  # @argument start_time [DateTime]\n  #   The beginning of the time range from which you want events.\n  #\n  # @argument end_time [DateTime]\n  #   The end of the time range from which you want events.\n  #\n  # @returns [GradeChangeEvent]\n  #","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/controllers/grade_change_audit_api_controller.rb#L170-L206","documentation":"Guard in GradeChangeAuditApiController#for_student: the student was found but is not an associated user of the current root account, so the audit query is refused with RecordNotFound to prevent cross-account data exposure.","triggerScenarios":"Thrown at app/controllers/grade_change_audit_api_controller.rb:188 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Query a student who is enrolled/associated with this root account","Confirm the admin querying has rights on the student's account"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}