bitwarden/server · error · BadRequestException

You must be authenticated to create a request of that type.

Error message

You must be authenticated to create a request of that type.

What it means

Thrown as BadRequestException with a custom message (HTTP 400) from POST /auth-requests (AllowAnonymous). When model.Type equals AuthRequestType.AdminApproval, the controller blocks the request because admin-approval auth requests must be created through the authenticated POST /auth-requests/admin-request endpoint. Anonymous creation of this type is not permitted.

Source

Thrown at src/Api/Auth/Controllers/AuthRequestsController.cs:84

    public async Task<AuthRequestResponseModel> GetResponse(Guid id, [FromQuery] string code)
    {
        var authRequest = await _authRequestService.GetValidatedAuthRequestAsync(id, code);

        if (authRequest == null)
        {
            throw new NotFoundException();
        }

        return new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);
    }

    [HttpPost("")]
    [AllowAnonymous]
    public async Task<AuthRequestResponseModel> Post([FromBody] AuthRequestCreateRequestModel model)
    {
        if (model.Type == AuthRequestType.AdminApproval)
        {
            throw new BadRequestException("You must be authenticated to create a request of that type.");
        }
        var authRequest = await _authRequestService.CreateAuthRequestAsync(model);
        var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);
        return r;
    }

    [HttpPost("admin-request")]
    public async Task<AuthRequestResponseModel> PostAdminRequest([FromBody] AuthRequestCreateRequestModel model)
    {
        if (model.Type != AuthRequestType.AdminApproval)
        {
            throw new BadRequestException("Invalid AuthRequestType. Expected AdminApproval.");
        }

        var authRequest = await _authRequestService.CreateAuthRequestAsync(model);
        var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);
        return r;
    }

View on GitHub (pinned to e93b962371)

Solutions

1. For AdminApproval requests, use POST /auth-requests/admin-request with an authenticated token instead of POST /auth-requests.
2. For standard (non-admin) auth requests, set Type to a non-AdminApproval value (e.g., Unlock, Login) when calling the anonymous endpoint.
3. Review the AuthRequestType enum to select the correct type for your use case.

Example fix

// before: wrong endpoint for admin approval
var resp = await client.PostAsJsonAsync("/auth-requests",
    new AuthRequestCreateRequestModel { Type = AuthRequestType.AdminApproval, ... }); // 400

// after: use the authenticated admin-request endpoint
client.DefaultRequestHeaders.Authorization = new("Bearer", token);
var resp = await client.PostAsJsonAsync("/auth-requests/admin-request",
    new AuthRequestCreateRequestModel { Type = AuthRequestType.AdminApproval, ... });

// Validate the auth request type before sending to the anonymous endpoint
if (model.Type == AuthRequestType.AdminApproval) {
    // Redirect to the authenticated admin-request endpoint
    return Error("AdminApproval requests require authentication. Use POST /auth-requests/admin-request.");
}
// Proceed with anonymous creation for non-admin types
await client.PostAsJsonAsync("/auth-requests", model);

static bool IsAnonymousAllowedType(AuthRequestType type) =>
    type != AuthRequestType.AdminApproval;

try {
    var resp = await client.PostAsJsonAsync("/auth-requests", model);
    resp.EnsureSuccessStatusCode();
} catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest) {
    if (model.Type == AuthRequestType.AdminApproval) {
        // Switch to the authenticated admin-request endpoint
        await EnsureAuthenticatedAsync();
        resp = await client.PostAsJsonAsync("/auth-requests/admin-request", model);
    }
}

When it happens

Trigger: An unauthenticated client sends POST /auth-requests with Type set to AdminApproval. This endpoint is [AllowAnonymous], so the request reaches the controller, but the type check immediately rejects it.

Common situations: Client incorrectly sends AdminApproval type to the anonymous endpoint instead of the admin-request endpoint. A library or SDK default sets Type to AdminApproval. Developer misunderstanding of which endpoint to call for admin approval requests.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid AuthRequestType. Expected AdminApproval.
• Org admin not found.
• Requested collections must belong to the same organization.
• The model state is invalid.
• User has existing keypair

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/30197325908024c5. Report an issue: GitHub.