bitwarden/server · error · NotFoundException

Resource not found.

Error message

Resource not found.

What it means

Thrown by SecretsController.ListByOrganizationAsync when ICurrentContext.AccessSecretsManager(organizationId) is false, i.e. the caller has no Secrets Manager access to the route organization. This is the first gate before any data is loaded. NotFoundException (body 'Resource not found.') prevents confirming the organization exists.

Source

Thrown at src/Api/SecretsManager/Controllers/SecretsController.cs:83

        _createSecretCommand = createSecretCommand;
        _updateSecretCommand = updateSecretCommand;
        _deleteSecretCommand = deleteSecretCommand;
        _accessClientQuery = accessClientQuery;
        _secretsSyncQuery = secretsSyncQuery;
        _secretAccessPoliciesUpdatesQuery = secretAccessPoliciesUpdatesQuery;
        _userService = userService;
        _eventService = eventService;
        _authorizationService = authorizationService;
        _organizationUserRepository = organizationUserRepository;

    }

    [HttpGet("organizations/{organizationId}/secrets")]
    public async Task<SecretWithProjectsListResponseModel> ListByOrganizationAsync([FromRoute] Guid organizationId)
    {
        if (!_currentContext.AccessSecretsManager(organizationId))
        {
            throw new NotFoundException();
        }

        var userId = _userService.GetProperUserId(User).Value;
        var orgAdmin = await _currentContext.OrganizationAdmin(organizationId);
        var accessClient = AccessClientHelper.ToAccessClient(_currentContext.IdentityClientType, orgAdmin);

        var secrets = await _secretRepository.GetManyDetailsByOrganizationIdAsync(organizationId, userId, accessClient);

        return new SecretWithProjectsListResponseModel(secrets);
    }

    [HttpPost("organizations/{organizationId}/secrets")]
    public async Task<SecretResponseModel> CreateAsync([FromRoute] Guid organizationId,
        [FromBody] SecretCreateRequestModel createRequest)
    {
        var secret = createRequest.ToSecret(organizationId);
        var authorizationResult = await _authorizationService.AuthorizeAsync(User, secret, SecretOperations.Create);
        if (!authorizationResult.Succeeded)

View on GitHub (pinned to e93b962371)

Solutions

1. Confirm the organization has Secrets Manager enabled.
2. Ensure the caller is a member with a Secrets Manager access policy for the organization.
3. Check that the route organizationId matches the token's scope.

// Locally confirm SM access before listing
if (!callerCanAccessSecretsManager(orgId)) return;

try { var secrets = await client.ListSecretsByOrgAsync(orgId); }
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.NotFound)
{ /* no SM access for org; prompt for access/enablement, do not retry */ }

When it happens

Trigger: GET /organizations/{organizationId}/secrets by a user or service account whose context grants no Secrets Manager access to that organizationId (org has SM disabled, caller is not a member, or no access policy).

Common situations: Organization has not enabled/purchased Secrets Manager; user is not a member of the org; service account token scoped to a different org; calling the wrong orgId after an org migration.

Related errors

• Resource not found.
• Resource not found.
• Resource not found.
• Resource not found.
• Unauthorized.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/33ee9eb3306fef13. Report an issue: GitHub.