bitwarden/server · error · BadRequestException

Invalid AuthRequestType. Expected AdminApproval.

Error message

Invalid AuthRequestType. Expected AdminApproval.

What it means

Thrown as BadRequestException with a custom message (HTTP 400) from POST /auth-requests/admin-request. When model.Type is NOT AuthRequestType.AdminApproval, the controller rejects it. The admin-request endpoint exclusively handles AdminApproval-type auth requests; any other type is a client error.

Source

Thrown at src/Api/Auth/Controllers/AuthRequestsController.cs:96

    [HttpPost("")]
    [AllowAnonymous]
    public async Task<AuthRequestResponseModel> Post([FromBody] AuthRequestCreateRequestModel model)
    {
        if (model.Type == AuthRequestType.AdminApproval)
        {
            throw new BadRequestException("You must be authenticated to create a request of that type.");
        }
        var authRequest = await _authRequestService.CreateAuthRequestAsync(model);
        var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);
        return r;
    }

    [HttpPost("admin-request")]
    public async Task<AuthRequestResponseModel> PostAdminRequest([FromBody] AuthRequestCreateRequestModel model)
    {
        if (model.Type != AuthRequestType.AdminApproval)
        {
            throw new BadRequestException("Invalid AuthRequestType. Expected AdminApproval.");
        }

        var authRequest = await _authRequestService.CreateAuthRequestAsync(model);
        var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);
        return r;
    }

    [HttpPut("{id}")]
    public async Task<AuthRequestResponseModel> Put(Guid id, [FromBody] AuthRequestUpdateRequestModel model)
    {
        var userId = _userService.GetProperUserId(User).Value;

        // If the Approving Device is attempting to approve a request, validate the approval
        if (model.RequestApproved == true)
        {
            await ValidateApprovalOfMostRecentAuthRequest(id, userId);
        }

View on GitHub (pinned to e93b962371)

Solutions

1. Set Type to AuthRequestType.AdminApproval when calling POST /auth-requests/admin-request.
2. For other auth request types (Login, Unlock), use POST /auth-requests instead.
3. Validate the Type field client-side before sending.

Example fix

// before: wrong type for admin-request endpoint
var resp = await client.PostAsJsonAsync("/auth-requests/admin-request",
    new AuthRequestCreateRequestModel { Type = AuthRequestType.Login, ... }); // 400

// after: use correct type
var resp = await client.PostAsJsonAsync("/auth-requests/admin-request",
    new AuthRequestCreateRequestModel { Type = AuthRequestType.AdminApproval, ... });

// Validate the type before calling the admin-request endpoint
if (model.Type != AuthRequestType.AdminApproval) {
    return Error("POST /auth-requests/admin-request only accepts AdminApproval type. Use POST /auth-requests for other types.");
}
await client.PostAsJsonAsync("/auth-requests/admin-request", model);

static bool IsValidForAdminEndpoint(AuthRequestType type) =>
    type == AuthRequestType.AdminApproval;

try {
    var resp = await client.PostAsJsonAsync("/auth-requests/admin-request", model);
    resp.EnsureSuccessStatusCode();
} catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest) {
    if (model.Type != AuthRequestType.AdminApproval) {
        // Route to the correct endpoint for this type
        resp = await client.PostAsJsonAsync("/auth-requests", model);
    }
}

When it happens

Trigger: An authenticated client calls POST /auth-requests/admin-request with a Type other than AdminApproval (e.g., Login, Unlock). The endpoint validates that the type matches its exclusive purpose.

Common situations: Client sends the wrong AuthRequestType to the admin-request endpoint. Copy-paste error where a standard auth request model is reused for an admin request. SDK or wrapper library defaults the Type field to a non-AdminApproval value.

Related errors

• You must be authenticated to create a request of that type.
• The model state is invalid.
• User has existing keypair
• AccountKeys are only supported for V2 encryption.
• You cannot delete accounts owned by an organization. Contact

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/1f93f8ad319e1028. Report an issue: GitHub.