{"record":{"id":"9ad4a99143123e73","repo":"bitwarden/server","slug":"you-do-not-have-permission-to-retrieve-a-connectio","errorCode":null,"errorMessage":"You do not have permission to retrieve a connection of type {type}.","messagePattern":"You do not have permission to retrieve a connection of type (.+?)\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs","lineNumber":123,"sourceCode":"        }\n\n        switch (model.Type)\n        {\n            case OrganizationConnectionType.CloudBillingSync:\n                return await CreateOrUpdateOrganizationConnectionAsync<BillingSyncConfig>(organizationConnectionId, model, ValidateBillingSyncConfig);\n            case OrganizationConnectionType.Scim:\n                return await CreateOrUpdateOrganizationConnectionAsync<ScimConfig>(organizationConnectionId, model);\n            default:\n                throw new BadRequestException($\"Unknown Organization connection Type: {model.Type}\");\n        }\n    }\n\n    [HttpGet(\"{organizationId}/{type}\")]\n    public async Task<OrganizationConnectionResponseModel> GetConnection(Guid organizationId, OrganizationConnectionType type)\n    {\n        if (!await HasPermissionAsync(organizationId, type))\n        {\n            throw new BadRequestException($\"You do not have permission to retrieve a connection of type {type}.\");\n        }\n\n        var connections = await GetConnectionsAsync(organizationId, type);\n        var connection = connections.FirstOrDefault(c => c.Type == type);\n\n        switch (type)\n        {\n            case OrganizationConnectionType.CloudBillingSync:\n                if (!_globalSettings.SelfHosted)\n                {\n                    throw new BadRequestException($\"Cannot get a {type} connection outside of a self-hosted instance.\");\n                }\n                return new OrganizationConnectionResponseModel(connection, typeof(BillingSyncConfig));\n            case OrganizationConnectionType.Scim:\n                return new OrganizationConnectionResponseModel(connection, typeof(ScimConfig));\n            default:\n                throw new BadRequestException($\"Unknown Organization connection Type: {type}\");\n        }","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs#L105-L141","documentation":"Thrown by GetConnection (GET /organizations/connections/{organizationId}/{type}) when HasPermissionAsync returns false for the given organizationId and type. Read access uses the same permission model as write: Scim requires ManageScim, the default branch requires OrganizationOwner. Maps to HTTP 400.","triggerScenarios":"GET /organizations/connections/{orgId}/{type} by a user who is not an Owner (for CloudBillingSync) or lacks ManageScim (for Scim); a route where organizationId is Guid.Empty so the permission check short-circuits to false.","commonSituations":"A read-only viewer or custom-scope token attempting to retrieve connection details; an org member (not owner) checking billing sync config; misrouted request with an empty org id.","solutions":["Call as a user who holds the required permission (Owner for CloudBillingSync, ManageScim for Scim).","Ensure organizationId in the route is a valid, non-empty Guid.","Grant the API key / service account the read-appropriate claim if applicable.","Use the ConnectionsEnabled endpoint first to confirm the feature is active before deeper calls."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (organizationId == Guid.Empty) throw new ArgumentException(\"organizationId required\");\nvar needsOwner = type != OrganizationConnectionType.Scim;\nvar ok = needsOwner\n    ? await currentUser.IsOrganizationOwnerAsync(organizationId)\n    : await currentUser.CanManageScimAsync(organizationId);\nif (!ok) throw new UnauthorizedAccessException();","typeGuard":"static bool IsKnownConnectionType(OrganizationConnectionType t) =>\n    t is OrganizationConnectionType.CloudBillingSync or OrganizationConnectionType.Scim;","tryCatchPattern":null,"preventionTips":["Resolve the caller's org permission before the GET.","Use the ConnectionsEnabled endpoint to confirm the feature is active first.","Ensure organizationId is a valid Guid."],"tags":["permissions","organization-connections","authorization","http-400"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}