[Bug]: Draft order detail page crashes with 404 error (User with id: apk_01M0Z6297SC580MRQE3G9HCG4B was not found)

[timhonders]

Package.json file

"dependencies": {
  "@medusajs/admin-sdk": "2.19.0",
  "@medusajs/admin-shared": "2.19.0",
  "@medusajs/caching": "2.19.0",
  "@medusajs/cli": "2.19.0",
  "@medusajs/dashboard": "2.19.0",
  "@medusajs/draft-order": "2.19.0",
  "@medusajs/framework": "2.19.0",
  "@medusajs/medusa": "2.19.0",
  "@medusajs/ui": "4.2.1",
  "@tanstack/react-query": "5.64.2",
  "react-i18next": "13.5.0",
  "react-router-dom": "7.18.2",
  "zod": "4.2.0"
}

Node.js version

v24.11.0

Database and its version

Postgres (Cloud)

Operating system name and version

Cloud

Browser name

No response

What happended?

For a POS System we are creating/editing a draftOrder, using the admin api with admin api key.

When u go to the drafOrder detail page it crashes with the message: User with id: apk_01M0.............E3G9HCG4B was not found

in file packages/plugins/draft-order/src/admin/components/draft-orders/activity-section.tsx on line 126 the 404 error is thrown

const { user, isPending, isError, error } = useUser(item.userId!, undefined, {
  enabled: !!item.userId,
})

if (isError) {
  throw error
}

it tries to fetch a user with the apk_ id witch doesn't exist

Steps to reproduce

1. Create a secret admin API key and point the JS SDK at it:

   const medusa = new Medusa({
     baseUrl: "http://localhost:9000",
     apiKey: "sk_…",
   })

2. Create a draft order, then edit it:

   await medusa.admin.draftOrder.beginEdit(draftOrderId)
   await medusa.admin.draftOrder.addItems(draftOrderId, {
     items: [{ variant_id: variantId, quantity: 1 }],
   })
   await medusa.admin.draftOrder.confirmEdit(draftOrderId)

3. Open that draft order in the admin dashboard. The page fails to render.

Expected behavior

Show activity "By Api user" or other message.

Actual behavior

draftOrder detail page crashes

Link to reproduction repo

no url

[medusa-os-bot]

Thanks for reporting this! We've labeled it as a bug and will investigate.

Confirmed bug in the draft-order plugin's activity section. When draft order operations (begin edit, add items, confirm edit) are performed using an admin API key, the confirmed_by field on the order change is set to the API key's ID (prefixed apk_). The ActivityItem component in activity-section.tsx unconditionally passes this ID to useUser(), which issues a user-lookup request that returns 404 — because API key IDs are not user IDs. On error, the component re-throws, crashing the entire draft order detail page. The fix needs to either: (1) detect non-user actor IDs in the frontend and skip/gracefully handle the lookup, or (2) record actor type separately in the backend so the UI can distinguish API key actors from user actors. Affects Medusa v2.19.0; reproduced via packages/plugins/draft-order/src/admin/components/draft-orders/activity-section.tsx line 125.

[breken-ai]

Reproduced the crash path: changes confirmed via an admin API key store the apk_ id in confirmed_by, and ActivityItem fetches it as a user id - the 404 is thrown into the error boundary and takes the page down. The dashboard already solved this shape in its shared By component (prefix-gate on user_, render null otherwise). This PR ports that convention to the draft-order plugin's activity section: fetch only user_ ids, never throw the lookup failure, and skip the By-row when the actor is not a resolvable user.

Fix is up: #16776

Built by breken, your AI support engineer - breken.ai finds the bug, proves the fix with unmatched RCA, answers customers in your voice, and keeps your code and support docs clean - this one's on us.