bitwarden/server · error · NotFoundException

Group not found.

Error message

Group not found.

What it means

Thrown as a NotFoundException (HTTP 404) by PutGroupCommand.PutGroupAsync when the group identified by {id} does not exist in the database or its OrganizationId does not match the {organization} parameter. PUT is a full-replace operation in SCIM 2.0, and this guard ensures the target resource is valid before overwriting it.

Source

Thrown at bitwarden_license/src/Scim/Groups/PutGroupCommand.cs:29

public class PutGroupCommand : IPutGroupCommand
{
    private readonly IGroupRepository _groupRepository;
    private readonly IUpdateGroupCommand _updateGroupCommand;

    public PutGroupCommand(
        IGroupRepository groupRepository,
        IUpdateGroupCommand updateGroupCommand)
    {
        _groupRepository = groupRepository;
        _updateGroupCommand = updateGroupCommand;
    }

    public async Task<Group> PutGroupAsync(Organization organization, Guid id, ScimGroupRequestModel model)
    {
        var group = await _groupRepository.GetByIdAsync(id);
        if (group == null || group.OrganizationId != organization.Id)
        {
            throw new NotFoundException("Group not found.");
        }

        group.Name = model.DisplayName;
        await _updateGroupCommand.UpdateGroupAsync(group, organization, EventSystemUser.SCIM);
        await UpdateGroupMembersAsync(group, model);

        return group;
    }

    private async Task UpdateGroupMembersAsync(Group group, ScimGroupRequestModel model)
    {
        if (model.Members == null)
        {
            return;
        }

        var memberIds = new List<Guid>();
        foreach (var id in model.Members.Select(i => i.Value))

View on GitHub (pinned to e93b962371)

Solutions

1. Verify the group exists via GET /v2/{organizationId}/Groups/{id}.
2. If deleted, create a new group via POST and update the IdP reference.
3. Confirm the organizationId in the request matches the SCIM token's org.
4. Reconcile the IdP directory to remove stale group references.

var existing = await scimClient.GetGroupAsync(orgId, groupId);
if (existing == null) { /* reconcile — re-provision or clear IdP ref */ return; }
// only then PUT

try { await scimClient.PutGroupAsync(orgId, groupId, model); }
catch (ScimException ex) when (ex.StatusCode == 404)
{ /* group gone — remove from IdP or re-create */ }

When it happens

Trigger: PUT /v2/{organizationId}/Groups/{id} where the group GUID was deleted or belongs to a different org. The IdP sends a full group replacement for a resource it believes exists but was removed.

Common situations: Group deleted in Bitwarden but IdP still references it. Org mismatch from wrong SCIM API key. Race condition: group deleted between a GET and a PUT in the IdP sync cycle.

Related errors

• User not found.
• User not found.
• ExternalId cannot exceed 300 characters.
• ExternalId already exists for another group.
• Conflict.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/33fe3fb293470e57. Report an issue: GitHub.