bitwarden/server · error · BadRequestException

User not found.

Error message

User not found.

What it means

Thrown by SyncController.Get (GET /sync) when _userService.GetUserByPrincipalAsync(User) returns null. This is an authenticated endpoint — the principal (claims from the JWT/access token) resolved to no user in the database. Notably this throws BadRequestException (HTTP 400), not NotFoundException, distinguishing it from resource-missing errors. It indicates the authentication token is valid enough to reach the endpoint but the user record is gone.

Source

Thrown at src/Api/Vault/Controllers/SyncController.cs:96

        _providerUserRepository = providerUserRepository;
        _policyRepository = policyRepository;
        _sendRepository = sendRepository;
        _globalSettings = globalSettings;
        _currentContext = currentContext;
        _featureService = featureService;
        _organizationAbilityCacheService = organizationAbilityCacheService;
        _twoFactorIsEnabledQuery = twoFactorIsEnabledQuery;
        _webAuthnCredentialRepository = webAuthnCredentialRepository;
        _userAccountKeysQuery = userAccountKeysQuery;
    }

    [HttpGet("")]
    public async Task<SyncResponseModel> Get([FromQuery] bool excludeDomains = false)
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new BadRequestException("User not found.");
        }

        var organizationUserDetails = await _organizationUserRepository.GetManyDetailsByUserAsync(user.Id,
            OrganizationUserStatusType.Confirmed);
        var providerUserDetails = await _providerUserRepository.GetManyDetailsByUserAsync(user.Id,
            ProviderUserStatusType.Confirmed);
        var providerUserOrganizationDetails =
            await _providerUserRepository.GetManyOrganizationDetailsByUserAsync(user.Id,
                ProviderUserStatusType.Confirmed);
        var hasEnabledOrgs = organizationUserDetails.Any(o => o.Enabled);

        var folders = await _folderRepository.GetManyByUserIdAsync(user.Id);
        var allCiphers = await _cipherRepository.GetManyByUserIdAsync(user.Id, withOrganizations: hasEnabledOrgs);
        var ciphers = FilterUnsupportedCipherTypes(allCiphers);
        var sends = await _sendRepository.GetManyByUserIdAsync(user.Id);

        IEnumerable<CollectionDetails> collections = null;
        IDictionary<Guid, IGrouping<Guid, CollectionCipher>> collectionCiphersGroupDict = null;

View on GitHub (pinned to e93b962371)

Solutions

  1. Have the user log out and back in to obtain a fresh authentication token
  2. Verify the user account still exists and is active in the database
  3. Check for recent account deletion or deactivation events
  4. On multi-region deployments, check for replication delays or shard routing issues
Defensive patterns

Strategy: try-catch

Try / catch

try
{
    var syncResponse = await api.GetSyncAsync();
}
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest)
{
    var body = await ex.Response?.Content?.ReadAsStringAsync();
    if (body == "User not found.")
    {
        // Session is stale — user account may have been deleted/deactivated
        // Force re-authentication
        await authService.LogoutAsync();
        NavigateToLogin();
    }
    throw;
}

Prevention

When it happens

Trigger: User account was deleted or deactivated while the session was still active; database replication lag on multi-region deployments means the user record isn't visible yet; stale access token after account deletion; the user record exists in a different database shard.

Common situations: Admin deleted/deactivated the user account while they had an active session; multi-region setup with replication delay; user was migrated to a different shard; auth token was issued before the user was fully provisioned.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/c91fd92030756391. Report an issue: GitHub.