Thanks andrius for making us aware!
We'll have a look as soon as possible and come back with proper feedback.

Best,
Tobias

Hi andrius,

I had a closer look at the code that handles the password policy requests:
https://github.com/camunda/camunda-bpm-platform/blob/4dab4f8be57ac96e4e0c5567d614569dbc027bb7/engine-rest/engine-rest/src/main/java/org/camunda/bpm/engine/rest/impl/IdentityRestServiceImpl.java#L99-L114

As long as the password policy is disabled (which is the default value), this request will return a 404 NOT FOUND.
Concerning the code, this behavior is expected and wouldn't qualify as a bug.
Plus, this behavior was consistently and deliberately used for password policy with CAM-9936.

Is this behavior preventing you to do anything specific or is this just irritating?

Best,
Tobias

Thanks for responding so quickly and for the explanation.

Actually, it's confusing to see REST errors while loading the UI. It always raises the question - is it expected or it's some real error (maybe result of a recent change or upgrade?).

I'm not sure if the engine configuration is available to the webapp. If it is - it may make sense to check if the password policy is enabled and only then ask for it.

That would spare many users one redundant request and this confusing 404.

Hi andrius,

I can totally relate to this argumentation, yes

I will rephrase the ticket to a TASK, proposing to avoid 404 resulting calls to the password policy in the web apps.
We might either use different calls from the web apps or adjust the answer of the REST API endpoint.
In the end, you can also argue that delivering an empty result for a GET request for the password policy is sufficient and a 404 is not appropriate here.

Thanks again for bringing this up.

Best,
Tobias