instructure/canvas-lms · error · ActiveRecord::RecordNotFound
Couldn't find user with API id '#
Error message
Couldn't find user with API id '#{params[:student_id]}' What it means
Guard in GradeChangeAuditApiController#for_student: the student was found but is not an associated user of the current root account, so the audit query is refused with RecordNotFound to prevent cross-account data exposure.
Solutions
- Query a student who is enrolled/associated with this root account
- Confirm the admin querying has rights on the student's account
Defensive patterns
Strategy: validation
When it happens
Trigger: Thrown at app/controllers/grade_change_audit_api_controller.rb:188 when the library encounters an invalid state.
Common situations: See trigger scenarios.
AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15).
Data as JSON: /api/errors/dfe7bf2e605ba85d.
Report an issue: GitHub.
Appendix: source
Thrown at app/controllers/grade_change_audit_api_controller.rb:188
# @API Query by student
#
# List grade change events for a given student.
#
# @argument start_time [DateTime]
# The beginning of the time range from which you want events.
#
# @argument end_time [DateTime]
# The end of the time range from which you want events.
#
# @returns [GradeChangeEvent]
#
def for_student
return render_unauthorized_action unless admin_authorized?
@student = api_find(User.active, params[:student_id])
unless @domain_root_account.associated_user?(@student)
raise ActiveRecord::RecordNotFound, "Couldn't find user with API id '#{params[:student_id]}'"
end
events = Auditors::GradeChange.for_root_account_student(@domain_root_account, @student, query_options)
render_events(events, api_v1_audit_grade_change_student_url(@student), remove_anonymous: true)
end
# @API Query by grader
#
# List grade change events for a given grader.
#
# @argument start_time [DateTime]
# The beginning of the time range from which you want events.
#
# @argument end_time [DateTime]
# The end of the time range from which you want events.
#
# @returns [GradeChangeEvent]
#View on GitHub (pinned to 1c9f0bb801)