{"record":{"id":"de9286213aefe3cf","repo":"bitwarden/server","slug":"you-do-not-have-permission-to-remove-this-connecti","errorCode":null,"errorMessage":"You do not have permission to remove this connection of type {connection.Type}.","messagePattern":"You do not have permission to remove this connection of type (.+?)\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs","lineNumber":156,"sourceCode":"                return new OrganizationConnectionResponseModel(connection, typeof(ScimConfig));\n            default:\n                throw new BadRequestException($\"Unknown Organization connection Type: {type}\");\n        }\n    }\n\n    [HttpDelete(\"{organizationConnectionId}\")]\n    public async Task DeleteConnection(Guid organizationConnectionId)\n    {\n        var connection = await _organizationConnectionRepository.GetByIdAsync(organizationConnectionId);\n\n        if (connection == null)\n        {\n            throw new NotFoundException();\n        }\n\n        if (!await HasPermissionAsync(connection.OrganizationId, connection.Type))\n        {\n            throw new BadRequestException($\"You do not have permission to remove this connection of type {connection.Type}.\");\n        }\n\n        await _deleteOrganizationConnectionCommand.DeleteAsync(connection);\n    }\n\n    private async Task<ICollection<OrganizationConnection>> GetConnectionsAsync(Guid organizationId, OrganizationConnectionType type) =>\n        await _organizationConnectionRepository.GetByOrganizationIdTypeAsync(organizationId, type);\n\n    private async Task<bool> HasConnectionTypeAsync(OrganizationConnectionRequestModel model, Guid? connectionId,\n        OrganizationConnectionType type)\n    {\n        var existingConnections = await GetConnectionsAsync(model.OrganizationId, type);\n\n        return existingConnections.Any(c => c.Type == model.Type && (!connectionId.HasValue || c.Id != connectionId.Value));\n    }\n\n    /// <summary>\n    /// Returns whether the current user has permission to manage a connection of the given <paramref name=\"type\"/>","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs#L138-L174","documentation":"Thrown by DeleteConnection (DELETE /organizations/connections/{id}) when HasPermissionAsync returns false for the fetched connection's OrganizationId and Type. Permission is type-dependent: Scim requires ManageScim, others require OrganizationOwner. The check uses the persisted connection's type, not anything from the request. Maps to HTTP 400.","triggerScenarios":"DELETE by a user who lacks the claim for the connection's type: a non-owner deleting CloudBillingSync; a user without ManageScim deleting Scim; calling from a different org context.","commonSituations":"A custom-scope API token without delete rights; a demoted admin whose cached token still references the connection; a multi-org UI deleting across the wrong tenant.","solutions":["Call as a user holding the permission for the connection's type (Owner for CloudBillingSync, ManageScim for Scim).","Re-authenticate after a role change so the token reflects current claims.","Use an API key / service account explicitly granted delete permission.","Confirm the connection belongs to an organization the caller can administer."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm delete permission based on the stored connection's type\nvar conn = await client.GetAsync<OrganizationConnectionResponseModel>($\"organizations/connections/{id}\");\nvar needsOwner = conn.Type != OrganizationConnectionType.Scim;\nvar ok = needsOwner\n    ? await currentUser.IsOrganizationOwnerAsync(conn.OrganizationId)\n    : await currentUser.CanManageScimAsync(conn.OrganizationId);\nif (!ok) throw new UnauthorizedAccessException();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check the caller holds the permission matching the connection's stored type before DELETE.","Re-authenticate after role changes.","Use an API key granted the delete claim."],"tags":["permissions","organization-connections","authorization","http-400"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}