What causes "User not found." in bitwarden/server?

Have the user log out and back in to obtain a fresh authentication token

bitwarden/server · error · BadRequestException

User not found.

Error message

User not found.

What it means

Thrown by SyncController.Get (GET /sync) when _userService.GetUserByPrincipalAsync(User) returns null. This is an authenticated endpoint — the principal (claims from the JWT/access token) resolved to no user in the database. Notably this throws BadRequestException (HTTP 400), not NotFoundException, distinguishing it from resource-missing errors. It indicates the authentication token is valid enough to reach the endpoint but the user record is gone.

Solutions

Have the user log out and back in to obtain a fresh authentication token
Verify the user account still exists and is active in the database
Check for recent account deletion or deactivation events
On multi-region deployments, check for replication delays or shard routing issues

Defensive patterns

Strategy: try-catch

Try / catch

try
{
    var syncResponse = await api.GetSyncAsync();
}
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest)
{
    var body = await ex.Response?.Content?.ReadAsStringAsync();
    if (body == "User not found.")
    {
        // Session is stale — user account may have been deleted/deactivated
        // Force re-authentication
        await authService.LogoutAsync();
        NavigateToLogin();
    }
    throw;
}

Prevention

Implement automatic re-authentication when sync returns 'User not found'
Monitor for account deletion or deactivation events that invalidate active sessions
On multi-region deployments, verify database replication health
Avoid caching sync responses — always fetch fresh on app launch

When it happens

Trigger: User account was deleted or deactivated while the session was still active; database replication lag on multi-region deployments means the user record isn't visible yet; stale access token after account deletion; the user record exists in a different database shard.

Common situations: Admin deleted/deactivated the user account while they had an active session; multi-region setup with replication delay; user was migrated to a different shard; auth token was issued before the user was fully provisioned.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/c91fd92030756391. Report an issue: GitHub.

Appendix: source

Thrown at src/Api/Vault/Controllers/SyncController.cs:96

        _providerUserRepository = providerUserRepository;
        _policyRepository = policyRepository;
        _sendRepository = sendRepository;
        _globalSettings = globalSettings;
        _currentContext = currentContext;
        _featureService = featureService;
        _organizationAbilityCacheService = organizationAbilityCacheService;
        _twoFactorIsEnabledQuery = twoFactorIsEnabledQuery;
        _webAuthnCredentialRepository = webAuthnCredentialRepository;
        _userAccountKeysQuery = userAccountKeysQuery;
    }

    [HttpGet("")]
    public async Task<SyncResponseModel> Get([FromQuery] bool excludeDomains = false)
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new BadRequestException("User not found.");
        }

        var organizationUserDetails = await _organizationUserRepository.GetManyDetailsByUserAsync(user.Id,
            OrganizationUserStatusType.Confirmed);
        var providerUserDetails = await _providerUserRepository.GetManyDetailsByUserAsync(user.Id,
            ProviderUserStatusType.Confirmed);
        var providerUserOrganizationDetails =
            await _providerUserRepository.GetManyOrganizationDetailsByUserAsync(user.Id,
                ProviderUserStatusType.Confirmed);
        var hasEnabledOrgs = organizationUserDetails.Any(o => o.Enabled);

        var folders = await _folderRepository.GetManyByUserIdAsync(user.Id);
        var allCiphers = await _cipherRepository.GetManyByUserIdAsync(user.Id, withOrganizations: hasEnabledOrgs);
        var ciphers = FilterUnsupportedCipherTypes(allCiphers);
        var sends = await _sendRepository.GetManyByUserIdAsync(user.Id);

        IEnumerable<CollectionDetails> collections = null;
        IDictionary<Guid, IGrouping<Guid, CollectionCipher>> collectionCiphersGroupDict = null;

View on GitHub (pinned to e93b962371)