bitwarden/server · warning · BadRequestException

No version IDs provided.

Error message

No version IDs provided.

What it means

Thrown by SecretVersionsController.GetManyByIdsAsync (and the parallel BulkDelete path) when the request body list of ids is empty. BadRequestException maps to HTTP 400 with message "No version IDs provided."

Source

Thrown at src/Api/SecretsManager/Controllers/SecretVersionsController.cs:107

        var orgAdmin = await _currentContext.OrganizationAdmin(secret.OrganizationId);
        var accessClient = AccessClientHelper.ToAccessClient(_currentContext.IdentityClientType, orgAdmin);

        var access = await _secretRepository.AccessToSecretAsync(secretVersion.SecretId, userId.Value, accessClient);
        if (!access.Read)
        {
            throw new NotFoundException();
        }

        return new SecretVersionResponseModel(secretVersion);
    }

    [HttpPost("secret-versions/get-by-ids")]
    public async Task<ListResponseModel<SecretVersionResponseModel>> GetManyByIdsAsync([FromBody] List<Guid> ids)
    {
        if (!ids.Any())
        {
            throw new BadRequestException("No version IDs provided.");
        }

        // Get all versions
        var versions = (await _secretVersionRepository.GetManyByIdsAsync(ids)).ToList();
        if (!versions.Any())
        {
            throw new NotFoundException();
        }

        // Get all associated secrets and check permissions
        var secretIds = versions.Select(v => v.SecretId).Distinct().ToList();
        var secrets = (await _secretRepository.GetManyByIds(secretIds)).ToList();

        if (!secrets.Any())
        {
            throw new NotFoundException();
        }

View on GitHub (pinned to e93b962371)

Solutions

1. Ensure the body array is non-empty before posting.
2. Guard the call site: skip the request when ids.Count == 0.
3. Validate the upstream selection that populates ids.

Example fix

// before
await client.PostAsync("/secret-versions/get-by-ids", ids);
// after
if (ids is null || ids.Count == 0) return;
await client.PostAsync("/secret-versions/get-by-ids", ids);

if (ids is null || ids.Count == 0) throw new ArgumentException("ids must be a non-empty list.");
await client.PostAsync("/secret-versions/get-by-ids", ids);

static bool HasVersionIds(IReadOnlyCollection<Guid> ids) => ids is { Count: > 0 };

When it happens

Trigger: POST /secret-versions/get-by-ids with an empty JSON array body ([]), or a null body deserialized to an empty list.

Common situations: Client submitted the request before populating ids; upstream filter produced zero ids; default/empty collection serialized.

Related errors

• You have reached the maximum number of projects ({max}) for
• Last synced date must be in the past.
• Only service accounts can sync secrets.
• You cannot import this much data at once, the limit is 1000
• A secret can only be in one project at a time.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/7f5920410764b555. Report an issue: GitHub.