bitwarden/server · error · BadRequestException

A maximum extension length is required when extensions are a

Error message

A maximum extension length is required when extensions are allowed.

What it means

Thrown as a BadRequestException (HTTP 400) by AccessRuleWriteValidator.ValidateAsync when AllowsExtensions is true but MaxExtensionDurationSeconds is not a positive integer. When an access rule permits time extensions, a maximum duration must be set to bound how long an extension can last.

Source

Thrown at bitwarden_license/src/Services/Pam/Services/AccessRuleWriteValidator.cs:39

        ICollectionRepository collectionRepository,
        IAccessRuleValidator conditionsValidator)
    {
        _repository = repository;
        _collectionRepository = collectionRepository;
        _conditionsValidator = conditionsValidator;
    }

    public async Task<List<Guid>> ValidateAsync(Guid organizationId, AccessRule rule,
        IEnumerable<Guid> collectionIds, Guid? existingRuleId = null)
    {
        if (string.IsNullOrWhiteSpace(rule.Name))
        {
            throw new BadRequestException("Name is required.");
        }

        if (rule.AllowsExtensions && rule.MaxExtensionDurationSeconds is not > 0)
        {
            throw new BadRequestException("A maximum extension length is required when extensions are allowed.");
        }

        var conditions = _conditionsValidator.Validate(rule.Conditions);
        if (!conditions.IsValid)
        {
            throw new BadRequestException(conditions.Error!);
        }

        await ValidateNameIsUniqueAsync(organizationId, rule.Name, existingRuleId);

        return await ValidateCollectionsAsync(organizationId, collectionIds, existingRuleId);
    }

    private async Task ValidateNameIsUniqueAsync(Guid organizationId, string name, Guid? existingRuleId)
    {
        var siblings = await _repository.GetManyByOrganizationIdAsync(organizationId);
        if (siblings.Any(r => r.Id != existingRuleId && string.Equals(r.Name, name, StringComparison.OrdinalIgnoreCase)))
        {

View on GitHub (pinned to e93b962371)

Solutions

1. Set maxExtensionDurationSeconds to a positive integer (e.g., 3600 for 1 hour) when allowsExtensions is true.
2. If extensions are not needed, set allowsExtensions to false.
3. Add a client-side co-validation: if extensions are enabled, require a max duration input.

Example fix

// before
//   { "name": "Rule", "allowsExtensions": true, "maxExtensionDurationSeconds": 0 }
// after
//   { "name": "Rule", "allowsExtensions": true, "maxExtensionDurationSeconds": 3600 }

if (rule.AllowsExtensions && !(rule.MaxExtensionDurationSeconds > 0))
    throw new InvalidOperationException("maxExtensionDurationSeconds must be > 0 when extensions are allowed");
// only then submit to API

try { await pamClient.CreateAccessRuleAsync(orgId, rule); }
catch (HttpRequestException ex) when (ex.Message.Contains("maximum extension length"))
{ /* set maxExtensionDurationSeconds or disable extensions, then retry */ }

When it happens

Trigger: Creating or updating a PAM AccessRule with allowsExtensions=true but maxExtensionDurationSeconds omitted, zero, or negative. The validator uses the pattern 'is not > 0', so null, 0, and negative values all trigger it.

Common situations: Client enables extensions in the UI but forgets to set a max duration. API request omits maxExtensionDurationSeconds because it was assumed optional. A migration script copies rules but drops the duration field.

Related errors

• Name is required.
• conditions.Error!
• ExternalId cannot exceed 300 characters.
• ExternalId cannot exceed 300 characters.
• result.AsError.Message

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/07c5b736796b8eb8. Report an issue: GitHub.