{"record":{"id":"0b280650d5dad0c1","repo":"bitwarden/server","slug":"your-organization-s-plan-does-not-support-this-fea","errorCode":null,"errorMessage":"Your organization's plan does not support this feature.","messagePattern":"Your organization's plan does not support this feature\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Dirt/Controllers/OrganizationReportsController.cs","lineNumber":480,"sourceCode":"        if (stream == null)\n        {\n            throw new NotFoundException();\n        }\n\n        return File(stream, \"application/octet-stream\", fileData.FileName);\n    }\n\n    private async Task AuthorizeAsync(Guid organizationId)\n    {\n        if (!await _currentContext.AccessReports(organizationId))\n        {\n            throw new NotFoundException();\n        }\n\n        var orgAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(organizationId);\n        if (orgAbility is null || !orgAbility.UseRiskInsights)\n        {\n            throw new BadRequestException(\"Your organization's plan does not support this feature.\");\n        }\n    }\n\n    private static void EnsureValidIds(Guid organizationId, Guid? reportId = null)\n    {\n        if (organizationId == Guid.Empty)\n        {\n            throw new BadRequestException(\"OrganizationId is required.\");\n        }\n\n        if (reportId.HasValue && reportId.Value == Guid.Empty)\n        {\n            throw new BadRequestException(\"ReportId is required.\");\n        }\n    }\n\n    private async Task<OrganizationReport> GetAuthorizedReportAsync(Guid organizationId, Guid reportId)\n    {","sourceCodeStart":462,"sourceCodeEnd":498,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Dirt/Controllers/OrganizationReportsController.cs#L462-L498","documentation":"Thrown by AuthorizeAsync when the organization's cached ability is null or UseRiskInsights is false. This means the organization's plan does not include the Risk Insights / Access Intelligence feature, so all report endpoints reject the call as 400. This is a plan/entitlement gate, not an authn/rbac gate (which would be 404 via error 315).","triggerScenarios":"The organization is on a plan tier (e.g. Free, Teams without risk-insights add-on) that does not set UseRiskInsights in its abilities, OR the ability cache has not yet been populated (orgAbility is null).","commonSituations":"Trial/expired Enterprise entitlement; org never purchased the risk-insights SKU; ability cache lag after a plan upgrade (cache hasn't refreshed); self-hosted without the feature licensed.","solutions":["Upgrade the organization to a plan that includes Risk Insights / Access Intelligence.","After upgrade, wait for the organization ability cache to refresh (or trigger a cache invalidation) and retry.","If orgAbility is consistently null, verify the ability cache service is wired and the org has a populated ability record."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var ability = await GetOrgAbilityAsync(organizationId);\nif (ability is null || !ability.UseRiskInsights)\n    throw new InvalidOperationException(\"Organization plan does not include Risk Insights.\");","typeGuard":null,"tryCatchPattern":"try { await client.GetAsync(reportUrl); }\ncatch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest && ex.Message.Contains(\"plan\"))\n{ /* prompt user to upgrade; do not retry until plan changes */ }","preventionTips":["Confirm the org's plan includes Risk Insights before building reports UX.","After an upgrade, allow ability-cache refresh time before retrying.","Treat this 400 as a hard entitlement stop, not a transient error."],"tags":["entitlement","plan","feature-gate","reports","csharp","aspnetcore"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}