{"record":{"id":"091ecb7ee06f12e0","repo":"bitwarden/server","slug":"you-cannot-delete-accounts-owned-by-an-organizatio","errorCode":null,"errorMessage":"You cannot delete accounts owned by an organization. Contact your admin for additional details.","messagePattern":"You cannot delete accounts owned by an organization\\. Contact your admin for additional details\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Auth/Controllers/AccountsController.cs","lineNumber":589,"sourceCode":"    public async Task Delete([FromBody] SecretVerificationRequestModel model)\n    {\n        var user = await _userService.GetUserByPrincipalAsync(User);\n        if (user == null)\n        {\n            throw new UnauthorizedAccessException();\n        }\n\n        if (!await _userService.VerifySecretAsync(user, model.Secret))\n        {\n            ModelState.AddModelError(string.Empty, \"User verification failed.\");\n            await Task.Delay(2000);\n        }\n        else\n        {\n            // Check if the user is claimed by any organization.\n            if (await _userService.IsClaimedByAnyOrganizationAsync(user.Id))\n            {\n                throw new BadRequestException(new CannotDeleteClaimedAccountError().Message);\n            }\n\n            var result = await _userService.DeleteAsync(user);\n            if (result.Succeeded)\n            {\n                return;\n            }\n\n            foreach (var error in result.Errors)\n            {\n                ModelState.AddModelError(string.Empty, error.Description);\n            }\n        }\n\n        throw new BadRequestException(ModelState);\n    }\n\n    [HttpPost(\"delete\")]","sourceCodeStart":571,"sourceCodeEnd":607,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Auth/Controllers/AccountsController.cs#L571-L607","documentation":"In DELETE /accounts, after secret verification passes, if _userService.IsClaimedByAnyOrganizationAsync(user.Id) is true the controller throws BadRequestException with the CannotDeleteClaimedAccountError message → HTTP 400. Users claimed by an organization (managed/owned accounts) cannot self-delete and must contact their admin.","triggerScenarios":"An organization-managed user (e.g. claimed via directory or enterprise ownership) attempts to delete their own account through DELETE /accounts.","commonSituations":"Enterprise/Teams member whose account is organization-owned; user provisioned by SCIM/directory and marked as claimed; user left an org but the claim record persists; org enabled account-claiming via policies.","solutions":["Direct the user to contact their organization administrator to remove or release the account.","If the claim is stale, have an admin unclaim the user in the admin console first, then retry.","Use the organization-level offboarding/removal path instead of self-service delete.","Confirm via GetOrganizationIdsClaimingUser whether the user is actually claimed before attempting delete."],"exampleFix":"// before\nawait client.DeleteAsync(\"accounts\"); // 400 claimed\n// after\nvar claiming = await GetClaimingOrgsAsync(user);\nif (claiming.Any()) PromptContactAdmin(claiming);\nelse await client.DeleteAsync(\"accounts\");","handlingStrategy":"type-guard","validationCode":"// Check claim status before attempting self-delete\nvar claiming = await GetOrganizationIdsClaimingUserAsync(userId);\nif (claiming.Any()) return; // cannot self-delete","typeGuard":"static bool CanSelfDelete(IReadOnlyList<Guid> claimingOrgs) => claimingOrgs is null || claimingOrgs.Count == 0;","tryCatchPattern":"try { await client.DeleteAsync(\"accounts\"); }\ncatch (BadRequestException ex) when (ex.Message.Contains(\"claimed\"))\n{ PromptContactAdmin(); }","preventionTips":["Surface the 'contact your admin' message instead of retrying.","Use admin offboarding for org-owned accounts.","Pre-check claim status via GetOrganizationIdsClaimingUser."],"tags":["validation","bad-request","delete-account","organization","claimed-account"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}