bitwarden/server · error · BadRequestException

Can only redeem sponsorship for an organization you own.

Error message

Can only redeem sponsorship for an organization you own.

What it means

Thrown (HTTP 400) when _currentContext.OrganizationOwner(model.SponsoredOrganizationId) returns false — the redeeming user is not an Owner of the sponsored organization. Only Owners may apply a sponsorship to their organization; Admins and lower roles are rejected.

Source

Thrown at src/Api/Billing/Controllers/OrganizationSponsorshipsController.cs:190

            _logger.LogWarning(
                "Sponsorship redemption failed: invalid token. SponsoredOrganizationId={SponsoredOrganizationId}, SponsorshipId={SponsorshipId}",
                model.SponsoredOrganizationId,
                sponsorship?.Id);
            throw new BadRequestException("Failed to parse sponsorship token.");
        }

        _logger.LogInformation(
            "Sponsorship token validated: SponsorshipId={SponsorshipId}, SponsoringOrganizationId={SponsoringOrganizationId}",
            sponsorship.Id,
            sponsorship.SponsoringOrganizationId);

        if (!await _currentContext.OrganizationOwner(model.SponsoredOrganizationId))
        {
            _logger.LogWarning(
                "Sponsorship redemption failed: user is not org owner. SponsoredOrganizationId={SponsoredOrganizationId}, SponsorshipId={SponsorshipId}",
                model.SponsoredOrganizationId,
                sponsorship.Id);
            throw new BadRequestException("Can only redeem sponsorship for an organization you own.");
        }

        var freeFamiliesSponsorshipPolicy = await _policyQuery.RunAsync(
            model.SponsoredOrganizationId, PolicyType.FreeFamiliesSponsorshipPolicy);

        if (freeFamiliesSponsorshipPolicy.Enabled)
        {
            _logger.LogWarning(
                "Sponsorship redemption failed: Free Families sponsorship has been disabled by org admin policy. SponsoredOrganizationId={SponsoredOrganizationId}, SponsorshipId={SponsorshipId}",
                model.SponsoredOrganizationId,
                sponsorship.Id);
            throw new BadRequestException("Free Bitwarden Families sponsorship has been disabled by your organization administrator.");
        }

        await _setUpSponsorshipCommand.SetUpSponsorshipAsync(
            sponsorship,
            await _organizationRepository.GetByIdAsync(model.SponsoredOrganizationId));

View on GitHub (pinned to e93b962371)

Solutions

1. Have an Owner of the sponsored organization perform the redemption.
2. Elevate the intended redeemer to the Owner role, then retry.
3. Confirm the SponsoredOrganizationId in the request matches an org the user owns.

// Confirm the current user is an Owner of the sponsored org before attempting redemption.
const isOwner = await isOrgOwner(sponsoredOrgId);
if (!isOwner) throw new Error('Only an organization Owner can redeem a sponsorship');

try {
  await redeemSponsorship(model);
} catch (e) {
  if (e.isBadRequest && /organization you own/i.test(e.message)) {
    prompt('Ask an Owner of this organization to redeem the sponsorship.');
  } else { throw e; }
}

When it happens

Trigger: A non-owner user (Admin, custom-role, or member) attempts redemption; the user is an owner of a different org; the user was demoted after the token was issued.

Common situations: The designated redeemer holds the Admin role but not Owner; user belongs to multiple orgs and targets the wrong one.

Related errors

• Only the owner of an organization can remove sponsorship.
• Free Bitwarden Families sponsorship has been disabled by you
• Can only revoke a sponsorship you granted.
• Failed to remove organization vault. Please contact support.
• Organization must have at least one confirmed owner.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/54e33d1ddbc8be63. Report an issue: GitHub.