{"record":{"id":"f58006ecd765e8d5","repo":"bitwarden/server","slug":"resource-not-found-f58006","errorCode":null,"errorMessage":"Resource not found.","messagePattern":"Resource not found\\.","errorType":"http","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"src/Api/AdminConsole/Controllers/OrganizationAuthRequestsController.cs","lineNumber":56,"sourceCode":"\n        var authRequests = await _authRequestRepository.GetManyPendingByOrganizationIdAsync(orgId);\n        var responses = authRequests\n            .Select(a => new PendingOrganizationAuthRequestResponseModel(a))\n            .ToList();\n        return new ListResponseModel<PendingOrganizationAuthRequestResponseModel>(responses);\n    }\n\n    [HttpPost(\"{requestId}\")]\n    public async Task UpdateAuthRequest(Guid orgId, Guid requestId, [FromBody] AdminAuthRequestUpdateRequestModel model)\n    {\n        await ValidateAdminRequest(orgId);\n\n        var authRequest =\n            (await _authRequestRepository.GetManyAdminApprovalRequestsByManyIdsAsync(orgId, new[] { requestId })).FirstOrDefault();\n\n        if (authRequest == null || authRequest.OrganizationId != orgId)\n        {\n            throw new NotFoundException();\n        }\n\n        await _updateOrganizationAuthRequestCommand.UpdateAsync(authRequest.Id, authRequest.UserId, model.RequestApproved, model.EncryptedUserKey);\n    }\n\n    [HttpPost(\"deny\")]\n    public async Task BulkDenyRequests(Guid orgId, [FromBody] BulkDenyAdminAuthRequestRequestModel model)\n    {\n        await ValidateAdminRequest(orgId);\n\n        var authRequests = await _authRequestRepository.GetManyAdminApprovalRequestsByManyIdsAsync(orgId, model.Ids);\n\n        foreach (var authRequest in authRequests)\n        {\n            await _authRequestService.UpdateAuthRequestAsync(authRequest.Id, authRequest.UserId,\n                new AuthRequestUpdateRequestModel { RequestApproved = false, });\n        }\n    }","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Controllers/OrganizationAuthRequestsController.cs#L38-L74","documentation":"Thrown by POST /{requestId} (UpdateAuthRequest) on OrganizationAuthRequestsController when GetManyAdminApprovalRequestsByManyIdsAsync returns no matching admin-approval request, or the returned request's OrganizationId != route orgId. Note this fires after ValidateAdminRequest, so the caller already passed the ManageResetPassword gate; the 404 is specifically that the org-recovery/key-connector auth request does not exist or is not pending admin approval.","triggerScenarios":"Approving/denying an org auth request (admin-initiated reset / SSO key connector approval) whose requestId is unknown, already resolved, or belongs to a different org. Only requests returned by the admin-approval query are visible; others look 'not found'.","commonSituations":"Approving a request that was already approved/denied or expired; stale requestId in the admin UI; cross-org requestId; race where the user cancelled the request.","solutions":["Re-fetch the pending admin-approval list and only act on requestIds still present.","On 404, treat the request as already handled/expired and refresh the queue.","Ensure the requestId was obtained from the same orgId's admin-approval query.","Do not retry approval on a 404 — it indicates the request is gone."],"exampleFix":"// before\nawait api.post(`/organizations/${orgId}/auth-requests/${requestId}`, { RequestApproved: true, ... });\n\n// after\nvar pending = await api.get(`/organizations/${orgId}/auth-requests/pending`);\nif (!pending.Any(r => r.Id == requestId)) { refreshQueue(); return; }\nawait api.post(`/organizations/${orgId}/auth-requests/${requestId}`, { RequestApproved: true, ... });","handlingStrategy":"validation","validationCode":"// Only act on requestIds still present in the admin-approval queue\nvar pending = await authRequestApi.GetPendingAdminAsync(orgId);\nif (!pending.Any(r => r.Id == requestId)) { refreshQueue(); return; }","typeGuard":"static bool RequestStillPending(AuthRequestSummary r, Guid orgId)\n    => r is not null && r.OrganizationId == orgId && r.IsPendingAdminApproval;","tryCatchPattern":"try { await api.PostAsync($\"/auth-requests/{requestId}\", body); }\ncatch (ApiException e) when (e.StatusCode == HttpStatusCode.NotFound)\n{ // already resolved/expired/gone — do not retry approval\n  refreshQueue(); }","preventionTips":["Re-fetch the pending admin-approval list before each action.","Obtain requestId only from the same orgId's approval query.","Treat 404 as resolved/expired and refresh, never as retriable."],"tags":["bitwarden","api","http-404","auth-requests","validation","aspnet"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}