medusajs/medusa · error · MedusaError

Policy with id: ${req.params.id} not found

Error message

Policy with id: ${req.params.id} not found

What it means

Thrown by GET /admin/rbac/policies/:id when the RBAC policy query returns an empty array. The policy is fetched by id with the requested fields; no match means the policy does not exist.

Source

Thrown at packages/medusa/src/api/admin/rbac/policies/[id]/route.ts:37

/**
 * @ignore
 * @featureFlag rbac
 */
export const GET = async (
  req: AuthenticatedMedusaRequest,
  res: MedusaResponse
) => {
  const query = req.scope.resolve(ContainerRegistrationKeys.QUERY)
  const { data: policies } = await query.graph({
    entity: "rbac_policy",
    filters: { id: req.params.id },
    fields: req.queryConfig.fields,
  })

  const policy = policies[0]

  if (!policy) {
    throw new MedusaError(
      MedusaError.Types.NOT_FOUND,
      `Policy with id: ${req.params.id} not found`
    )
  }

  res.status(200).json({ policy })
}

/**
 * @ignore
 * @featureFlag rbac
 */
export const POST = async (
  req: AuthenticatedMedusaRequest<AdminUpdateRbacPolicyType>,
  res: MedusaResponse
) => {
  const query = req.scope.resolve(ContainerRegistrationKeys.QUERY)
  const { data: existing } = await query.graph({

View on GitHub (pinned to 5e06e544a2)

Solutions

1. List policies (GET /admin/rbac/policies) to confirm the id exists
2. If policies were regenerated, update references to the new ids
3. Handle 404 by refreshing the policies list in the UI

Example fix

// before
const { policy } = await sdk.client.fetch(`/admin/rbac/policies/${id}`)

// after
const { policies } = await sdk.client.fetch("/admin/rbac/policies")
if (!policies.some((p) => p.id === id)) throw new Error(`Policy ${id} not found`)
const policy = policies.find((p) => p.id === id)

const { policies } = await sdk.client.fetch("/admin/rbac/policies")
if (!policies.some((p) => p.id === policyId)) throw new Error(`Policy ${policyId} not found`)

const isPolicy = (v: unknown): v is { id: string } & Record<string, unknown> =>
  !!v && typeof v === "object" && "id" in v

try {
  return await getPolicy(id)
} catch (e: any) {
  if (e.statusCode === 404) return null
  throw e
}

When it happens

Trigger: Calling GET /admin/rbac/policies/pol_123 for a policy id that was deleted or never created.

Common situations: Admin RBAC editors with stale policy lists after policies were removed or regenerated, or scripts referencing policies from another environment.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Policy with id "${req.params.id}" not found
• Role with id: ${req.params.id} not found
• Invite with id: ${id} was not found
• Price list with id: ${id} was not found
• Product category with id: ${req.params.id} was not found

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/6d312c7740200a16. Report an issue: GitHub.