bitwarden/server · error · NotFoundException

Resource not found.

Error message

Resource not found.

What it means

Thrown by BulkDeleteAsync when GetProperUserId returns no value for the authenticated principal. The caller authenticated past [Authorize("secrets")] but has no resolvable user/service-account id, so per-user access checks cannot run. NotFoundException (body 'Resource not found.') masks the authentication gap.

Source

Thrown at src/Api/SecretsManager/Controllers/SecretVersionsController.cs:263

        var secrets = await _secretRepository.GetManyByIds(secretIds);
        var secretsList = secrets.ToList();

        if (!secretsList.Any())
        {
            throw new NotFoundException();
        }

        var organizationId = secretsList.First().OrganizationId;
        if (secretsList.Any(s => s.OrganizationId != organizationId) ||
            !_currentContext.AccessSecretsManager(organizationId))
        {
            throw new NotFoundException();
        }

        var userId = _userService.GetProperUserId(User);
        if (!userId.HasValue)
        {
            throw new NotFoundException();
        }

        var orgAdmin = await _currentContext.OrganizationAdmin(organizationId);
        var accessClient = AccessClientHelper.ToAccessClient(_currentContext.IdentityClientType, orgAdmin);

        var accessResults = await _secretRepository.AccessToSecretsAsync(secretIds, userId.Value, accessClient);
        if (accessResults.Count != secretIds.Count || accessResults.Values.Any(access => !access.Write))
        {
            throw new NotFoundException();
        }

        await _secretVersionRepository.DeleteManyByIdAsync(ids);

        return Ok();
    }
}

View on GitHub (pinned to e93b962371)

Solutions

1. Use a token that resolves to a concrete user or service account id.
2. Re-authenticate to get a token with a valid user id claim.
3. Verify the auth middleware populates the user id on the principal.

try { await client.PostAsync("secret-versions/delete", ids); }
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.NotFound)
{ /* principal has no resolvable user id; re-authenticate */ }

When it happens

Trigger: An authenticated request with a principal that carries no mappable user id (e.g. certain machine/installation tokens) reaches the bulk-delete endpoint.

Common situations: A token type without a user id claim is used on a user-scoped endpoint; partially-issued or degraded token; auth pipeline misconfiguration dropping the user claim.

Related errors

• Resource not found.
• Last synced date must be in the past.
• Only service accounts can sync secrets.
• Resource not found.
• Resource not found.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/33d0a51993f7d078. Report an issue: GitHub.