{"record":{"id":"7553491bf65637c2","repo":"bitwarden/server","slug":"cannot-verify-license-file","errorCode":null,"errorMessage":"Cannot verify license file.","messagePattern":"Cannot verify license file\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs","lineNumber":205,"sourceCode":"        }\n        return type switch\n        {\n            OrganizationConnectionType.Scim => await _currentContext.ManageScim(organizationId.Value),\n            _ => await _currentContext.OrganizationOwner(organizationId.Value),\n        };\n    }\n\n    private async Task ValidateBillingSyncConfig(OrganizationConnectionRequestModel<BillingSyncConfig> typedModel)\n    {\n        if (!_globalSettings.SelfHosted)\n        {\n            throw new BadRequestException($\"Cannot create a {typedModel.Type} connection outside of a self-hosted instance.\");\n        }\n        var license = await _licensingService.ReadOrganizationLicenseAsync(typedModel.OrganizationId);\n\n        if (license == null || !_licensingService.VerifyLicense(license))\n        {\n            throw new BadRequestException(\"Cannot verify license file.\");\n        }\n        typedModel.ParsedConfig.CloudOrganizationId = license.Id;\n    }\n\n    private async Task<OrganizationConnectionResponseModel> CreateOrUpdateOrganizationConnectionAsync<T>(\n        Guid? organizationConnectionId,\n        OrganizationConnectionRequestModel model,\n        Func<OrganizationConnectionRequestModel<T>, Task>? validateAction = null)\n        where T : IConnectionConfig\n    {\n        var typedModel = new OrganizationConnectionRequestModel<T>(model);\n        if (validateAction != null)\n        {\n            await validateAction(typedModel);\n        }\n\n        var data = typedModel.ToData(organizationConnectionId);\n        var connection = organizationConnectionId.HasValue","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs#L187-L223","documentation":"Thrown by ValidateBillingSyncConfig when ReadOrganizationLicenseAsync returns null (no license file for the org) or VerifyLicense returns false (signature invalid / expired / tampered). Billing Sync requires a valid organization license to derive the CloudOrganizationId, so a missing or unverifiable license blocks connection creation. Maps to HTTP 400.","triggerScenarios":"POST/PUT a CloudBillingSync connection when the organization has no installed license file on the self-hosted server, or the installed license is expired, revoked, signed by an untrusted key, or corrupted.","commonSituations":"License never installed on the self-hosted instance; license expired and not renewed; server clock skew causing signature/expiry validation failure; license file corrupted during transfer; wrong signing key configured on the server.","solutions":["Generate and install a valid organization license (from the cloud org owner portal) onto the self-hosted instance.","Renew an expired license and reinstall the new file.","Verify the server's system clock is correct (NTP) so license expiry/signature checks pass.","Confirm the licensing public key configured on the server matches the key that signed the license.","Check that ReadOrganizationLicenseAsync can locate the license file path for the org."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Ensure a valid org license is installed before creating BillingSync\nvar license = await licensingService.ReadOrganizationLicenseAsync(orgId);\nif (license == null) throw new InvalidOperationException(\"No organization license installed.\");\nif (!licensingService.VerifyLicense(license)) throw new InvalidOperationException(\"License failed verification.\");","typeGuard":null,"tryCatchPattern":"try { await client.PostAsync(\"organizations/connections\", billingSyncBody); }\ncatch (ApiException ex) when (ex.Message.Contains(\"Cannot verify license\")) {\n    // prompt admin to install/renew the org license, then retry\n}","preventionTips":["Install a current, signed organization license on the self-hosted instance first.","Keep the server clock synced via NTP so expiry/signature checks pass.","Confirm the server's configured licensing public key matches the license signer.","Renew licenses before expiry."],"tags":["licensing","billing-sync","organization-connections","http-400"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}