{"record":{"id":"e4c9a166bcbada5d","repo":"flarum/framework","slug":"modelnotfoundexception","errorCode":null,"errorMessage":"ModelNotFoundException","messagePattern":"ModelNotFoundException","errorType":"http","errorClass":"ModelNotFoundException","httpStatus":404,"severity":"error","filePath":"framework/core/src/Api/Resource/AccessTokenResource.php","lineNumber":138,"sourceCode":"\n    /**\n     * @param AccessToken $model\n     * @param \\Flarum\\Api\\Context $context\n     * @throws PermissionDeniedException\n     */\n    public function delete(object $model, \\Tobyz\\JsonApiServer\\Context $context): void\n    {\n        /** @var Session|null $session */\n        $session = $context->request->getAttribute('session');\n\n        // Current session should only be terminated through logout.\n        if ($session && $model->token === $session->get('access_token')) {\n            throw new PermissionDeniedException();\n        }\n\n        // Don't give away the existence of the token.\n        if ($context->getActor()->cannot('revoke', $model)) {\n            throw new ModelNotFoundException();\n        }\n\n        $model->delete();\n    }\n}\n","sourceCodeStart":120,"sourceCodeEnd":144,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/framework/core/src/Api/Resource/AccessTokenResource.php#L120-L144","documentation":"In AccessTokenResource::delete, after the current-session guard, a ModelNotFoundException (404-equivalent) is raised when the token model does not exist or belongs to another user — deliberately surfaced as 'not found' so the API does not reveal whether a token with that id exists.","triggerScenarios":"Thrown at framework/core/src/Api/Resource/AccessTokenResource.php:138 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the token id in the DELETE request is correct and still exists","Confirm the authenticated user owns the token being deleted","Handle the 404 in the client without retrying; treat it as 'already gone' and clean up local state"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}