instructure/canvas-lms · error · ActiveRecord::RecordNotFound

Couldn't find user with API id '#

Error message

Couldn't find user with API id '#{params[:student_id]}'

What it means

Guard in GradeChangeAuditApiController#for_student: the student was found but is not an associated user of the current root account, so the audit query is refused with RecordNotFound to prevent cross-account data exposure.

Solutions

  1. Query a student who is enrolled/associated with this root account
  2. Confirm the admin querying has rights on the student's account
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at app/controllers/grade_change_audit_api_controller.rb:188 when the library encounters an invalid state.

Common situations: See trigger scenarios.


AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/dfe7bf2e605ba85d. Report an issue: GitHub.

Appendix: source

Thrown at app/controllers/grade_change_audit_api_controller.rb:188

  # @API Query by student
  #
  # List grade change events for a given student.
  #
  # @argument start_time [DateTime]
  #   The beginning of the time range from which you want events.
  #
  # @argument end_time [DateTime]
  #   The end of the time range from which you want events.
  #
  # @returns [GradeChangeEvent]
  #
  def for_student
    return render_unauthorized_action unless admin_authorized?

    @student = api_find(User.active, params[:student_id])
    unless @domain_root_account.associated_user?(@student)
      raise ActiveRecord::RecordNotFound, "Couldn't find user with API id '#{params[:student_id]}'"
    end

    events = Auditors::GradeChange.for_root_account_student(@domain_root_account, @student, query_options)
    render_events(events, api_v1_audit_grade_change_student_url(@student), remove_anonymous: true)
  end

  # @API Query by grader
  #
  # List grade change events for a given grader.
  #
  # @argument start_time [DateTime]
  #   The beginning of the time range from which you want events.
  #
  # @argument end_time [DateTime]
  #   The end of the time range from which you want events.
  #
  # @returns [GradeChangeEvent]
  #

View on GitHub (pinned to 1c9f0bb801)