flarum/framework · error · ModelNotFoundException

ModelNotFoundException

Error message

ModelNotFoundException

What it means

In AccessTokenResource::delete, after the current-session guard, a ModelNotFoundException (404-equivalent) is raised when the token model does not exist or belongs to another user — deliberately surfaced as 'not found' so the API does not reveal whether a token with that id exists.

Solutions

1. Verify the token id in the DELETE request is correct and still exists
2. Confirm the authenticated user owns the token being deleted
3. Handle the 404 in the client without retrying; treat it as 'already gone' and clean up local state

When it happens

Trigger: Thrown at framework/core/src/Api/Resource/AccessTokenResource.php:138 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/e4c9a166bcbada5d. Report an issue: GitHub.

Appendix: source

Thrown at framework/core/src/Api/Resource/AccessTokenResource.php:138

    /**
     * @param AccessToken $model
     * @param \Flarum\Api\Context $context
     * @throws PermissionDeniedException
     */
    public function delete(object $model, \Tobyz\JsonApiServer\Context $context): void
    {
        /** @var Session|null $session */
        $session = $context->request->getAttribute('session');

        // Current session should only be terminated through logout.
        if ($session && $model->token === $session->get('access_token')) {
            throw new PermissionDeniedException();
        }

        // Don't give away the existence of the token.
        if ($context->getActor()->cannot('revoke', $model)) {
            throw new ModelNotFoundException();
        }

        $model->delete();
    }
}

View on GitHub (pinned to 4b939f6853)