bitwarden/server · error · NotFoundException

Resource not found.

Error message

Resource not found.

What it means

Thrown by GET /organizations/{organizationId}/integrations/{integrationId}/configurations when the caller is not an owner of the organization. HasPermission delegates to currentContext.OrganizationOwner(organizationId); failure is reported as a generic NotFoundException (HTTP 404) rather than 403, to avoid leaking the existence of integration configurations to unauthorized users.

Source

Thrown at src/Api/Dirt/Controllers/OrganizationIntegrationConfigurationController.cs:27

namespace Bit.Api.Dirt.Controllers;

[Route("organizations/{organizationId:guid}/integrations/{integrationId:guid}/configurations")]
[Authorize("Application")]
public class OrganizationIntegrationConfigurationController(
    ICurrentContext currentContext,
    ICreateOrganizationIntegrationConfigurationCommand createCommand,
    IUpdateOrganizationIntegrationConfigurationCommand updateCommand,
    IDeleteOrganizationIntegrationConfigurationCommand deleteCommand,
    IGetOrganizationIntegrationConfigurationsQuery getQuery) : Controller
{
    [HttpGet("")]
    public async Task<List<OrganizationIntegrationConfigurationResponseModel>> GetAsync(
        Guid organizationId,
        Guid integrationId)
    {
        if (!await HasPermission(organizationId))
        {
            throw new NotFoundException();
        }

        var configurations = await getQuery.GetManyByIntegrationAsync(organizationId, integrationId);
        return configurations
            .Select(configuration => new OrganizationIntegrationConfigurationResponseModel(configuration))
            .ToList();
    }

    [HttpPost("")]
    public async Task<OrganizationIntegrationConfigurationResponseModel> CreateAsync(
        Guid organizationId,
        Guid integrationId,
        [FromBody] OrganizationIntegrationConfigurationRequestModel model)
    {
        if (!await HasPermission(organizationId))
        {
            throw new NotFoundException();
        }

View on GitHub (pinned to e93b962371)

Solutions

1. Call the endpoint as a user who holds the Owner role on the target organization.
2. If using an API token / service account, ensure it is scoped to an owner-level principal or re-issue the call from an owner account.
3. Confirm the organizationId in the path is the org the caller actually owns — a stale/wrong org id will always fail this check.

// Client-side: only show the configurations UI when the user is an owner
var me = await GetCurrentUserAsync();
var isOwner = await IsOrgOwnerAsync(me.Id, organizationId);
if (!isOwner) { /* hide/disable the configurations call */ }

try { var cfgs = await client.GetAsync($"/organizations/{orgId}/integrations/{intId}/configurations"); }
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.NotFound)
{ /* either no configs or not an owner — treat as 'not available' */ }

When it happens

Trigger: Any authenticated user who is NOT an organization owner calls the GET configurations endpoint — e.g. an admin, a custom-role user, or a manager. Also fires for a user who was removed from the org but still holds a valid session token.

Common situations: Calling the endpoint with a service account or API key that lacks the Owner role; testing with a non-owner user account; org membership recently revoked but client still cached the session.

Related errors

• Invalid report ID
• Can only redeem sponsorship for an organization you own.
• Only the owner of an organization can remove sponsorship.
• Request failed. Status code: {0}
• Max file size is 500 MB.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/53ab7e37e4c9b8b3. Report an issue: GitHub.