bitwarden/server · error · NotFoundException

Resource not found.

Error message

Resource not found.

What it means

Thrown as NotFoundException (HTTP 404) from GET /auth-requests/{id}. _authRequestService.GetAuthRequestAsync(id, userId) returns null — no auth request exists with the given id that belongs to the requesting user. The controller requires both the correct id and ownership (userId match).

Source

Thrown at src/Api/Auth/Controllers/AuthRequestsController.cs:49

    [HttpGet("")]
    public async Task<ListResponseModel<AuthRequestResponseModel>> GetAll()
    {
        var userId = _userService.GetProperUserId(User).Value;
        var authRequests = await _authRequestRepository.GetManyByUserIdAsync(userId);
        var responses = authRequests.Select(a => new AuthRequestResponseModel(a, _globalSettings.BaseServiceUri.Vault));
        return new ListResponseModel<AuthRequestResponseModel>(responses);
    }

    [HttpGet("{id}")]
    public async Task<AuthRequestResponseModel> Get(Guid id)
    {
        var userId = _userService.GetProperUserId(User).Value;
        var authRequest = await _authRequestService.GetAuthRequestAsync(id, userId);

        if (authRequest == null)
        {
            throw new NotFoundException();
        }

        return new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);
    }

    [HttpGet("pending")]
    public async Task<ListResponseModel<PendingAuthRequestResponseModel>> GetPendingAuthRequestsAsync()
    {
        var userId = _userService.GetProperUserId(User).Value;
        var rawResponse = await _authRequestRepository.GetManyPendingAuthRequestByUserId(userId);
        var responses = rawResponse.Select(a => new PendingAuthRequestResponseModel(a, _globalSettings.BaseServiceUri.Vault));
        return new ListResponseModel<PendingAuthRequestResponseModel>(responses);
    }

    [HttpGet("{id}/response")]
    [AllowAnonymous]
    public async Task<AuthRequestResponseModel> GetResponse(Guid id, [FromQuery] string code)
    {

View on GitHub (pinned to e93b962371)

Solutions

1. Call GET /auth-requests to list the user's current auth requests and use a valid ID from the result.
2. If the request was for device login, initiate a new auth request via POST /auth-requests.
3. Verify the GUID is correctly formatted and belongs to the authenticated user.

Example fix

// before: using a stale ID
var resp = await client.GetAsync($"/auth-requests/{oldRequestId}"); // 404

// after: fetch current list first
var list = await client.GetAsync("/auth-requests");
var currentId = ParseLatestRequestId(list);
var resp = await client.GetAsync($"/auth-requests/{currentId}");

// Verify the auth request ID exists in the user's list before fetching
var list = await client.GetAsync("/auth-requests");
var validIds = ParseAuthRequestIds(list);
if (!validIds.Contains(requestedId)) {
    return Error("Auth request not found. It may have expired or been deleted.");
}

try {
    var resp = await client.GetAsync($"/auth-requests/{id}");
    resp.EnsureSuccessStatusCode();
} catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.NotFound) {
    // Auth request doesn't exist or belongs to another user
    // Refresh the pending list or create a new auth request
    await RefreshAuthRequestListAsync();
}

When it happens

Trigger: GET /auth-requests/{id} is called with a GUID that does not exist or belongs to a different user. The auth request may have been deleted, expired, or was never created.

Common situations: Client uses a stale auth request ID from a previous session. The auth request was already consumed or expired and cleaned up. User A tries to access an auth request belonging to user B (ownership enforcement). The ID was transcribed or copy-pasted incorrectly.

Related errors

• Organization must have at least one confirmed owner.
• Provider must have at least one confirmed ProviderAdmin.
• User not found.
• Group not found.
• User not found.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/549a5350a961fadd. Report an issue: GitHub.