{"record":{"id":"bec8db965355b196","repo":"bitwarden/server","slug":"to-grant-pam-access-the-organization-must-have-pam","errorCode":null,"errorMessage":"To grant PAM access the organization must have PAM enabled.","messagePattern":"To grant PAM access the organization must have PAM enabled\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/AdminConsole/Controllers/OrganizationUsersController.cs","lineNumber":824,"sourceCode":"    /// </summary>\n    [HttpPut(\"enable-pam\")]\n    [Authorize<ManageUsersRequirement>]\n    public async Task BulkEnablePamAsync(Guid orgId,\n        [FromBody] OrganizationUserBulkRequestModel model)\n    {\n        var orgUsers = (await _organizationUserRepository.GetManyAsync(model.Ids))\n            .Where(ou => ou.OrganizationId == orgId && !ou.AccessPam).ToList();\n        if (orgUsers.Count == 0)\n        {\n            throw new BadRequestException(new UsersInvalid().Message);\n        }\n\n        // Granting access on an organization without PAM would be inert: claim emission ANDs AccessPam with the\n        // organization's UsePam.\n        var organization = await _organizationRepository.GetByIdAsync(orgId);\n        if (organization is not { UsePam: true })\n        {\n            throw new BadRequestException(new V2_UpdateUserCommand.PamNotEnabled().Message);\n        }\n\n        foreach (var orgUser in orgUsers)\n        {\n            orgUser.AccessPam = true;\n        }\n\n        await _organizationUserRepository.ReplaceManyAsync(orgUsers);\n    }\n\n    [HttpPost(\"{id}/auto-confirm\")]\n    [Authorize<ManageUsersRequirement>]\n    public async Task<IResult> AutomaticallyConfirmOrganizationUserAsync([FromRoute] Guid orgId,\n        [FromRoute] Guid id,\n        [FromBody] OrganizationUserConfirmRequestModel model)\n    {\n        var userId = _userService.GetProperUserId(User);\n","sourceCodeStart":806,"sourceCodeEnd":842,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs#L806-L842","documentation":"Error \"To grant PAM access the organization must have PAM enabled.\" thrown in bitwarden/server.","triggerScenarios":"Thrown when attempting to grant a user PAM access for an organization that does not have the PAM feature enabled on its plan.","commonSituations":"See trigger scenarios.","solutions":["Enable PAM for the organization in the billing/subscription settings before granting PAM access.","Contact Bitwarden support or your account manager to add PAM to the organization's plan."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}