bitwarden/server · error · BadRequestException

Cannot autoscale on a self-hosted instance.

Error message

Cannot autoscale on a self-hosted instance.

What it means

Thrown by CreateAsync when the organization is self-hosted AND creating this service account would require additional service-account slots (autoscaling). Self-hosted instances cannot automatically adjust a Stripe subscription, so the server rejects the creation with a 400 BadRequest before touching billing. The guard fires only when newServiceAccountSlotsRequired > 0 on a self-hosted deployment.

Source

Thrown at src/Api/SecretsManager/Controllers/ServiceAccountsController.cs:143

        [FromBody] ServiceAccountCreateRequestModel createRequest)
    {
        var serviceAccount = createRequest.ToServiceAccount(organizationId);
        var authorizationResult =
            await _authorizationService.AuthorizeAsync(User, serviceAccount, ServiceAccountOperations.Create);

        if (!authorizationResult.Succeeded)
        {
            throw new NotFoundException();
        }

        var newServiceAccountSlotsRequired = await _countNewServiceAccountSlotsRequiredQuery
            .CountNewServiceAccountSlotsRequiredAsync(organizationId, 1);
        if (newServiceAccountSlotsRequired > 0)
        {
            // Self-hosted instances can't autoscale their Stripe subscription, so reject before touching billing.
            if (_globalSettings.SelfHosted)
            {
                throw new BadRequestException("Cannot autoscale on a self-hosted instance.");
            }

            var org = await _organizationRepository.GetByIdAsync(organizationId);
            var plan = await _pricingClient.GetPlanOrThrow(org!.PlanType);
            var update = new SecretsManagerSubscriptionUpdate(org, plan, true)
                .AdjustServiceAccounts(newServiceAccountSlotsRequired);
            await _updateSecretsManagerSubscriptionCommand.UpdateSubscriptionAsync(update);
        }

        var userId = _userService.GetProperUserId(User).Value;

        var result =
            await _createServiceAccountCommand.CreateAsync(serviceAccount, userId);

        if (result != null)
        {
            await _eventService.LogServiceAccountEventAsync(userId, [serviceAccount], EventType.ServiceAccount_Created, _currentContext.IdentityClientType);
        }

View on GitHub (pinned to e93b962371)

Solutions

1. Increase the service-account slot count in the self-hosted license/subscription before creating new service accounts.
2. Delete an unused service account to free a slot, then retry the creation.
3. Contact Bitwarden to update the self-hosted license with additional service-account seats.

Example fix

// before: at slot limit on self-hosted
POST /organizations/{orgId}/service-accounts  // -> 400
// after: free a slot or update license, then retry
DELETE /service-accounts/{unusedId}
POST /organizations/{orgId}/service-accounts  // -> 200

// On self-hosted: check available slots before creating
var slotsNeeded = await countSlotsQuery.CountNewServiceAccountSlotsRequiredAsync(orgId, 1);
if (globalSettings.SelfHosted && slotsNeeded > 0)
{
    return BadRequest("Free a slot or upgrade the license before creating a service account.");
}
await serviceAccountsClient.CreateAsync(organizationId, request);

try { await client.CreateAsync(orgId, req); }
catch (ApiException ex) when (ex.Message.Contains("autoscale")) { /* upgrade license */ }

When it happens

Trigger: POST /organizations/{organizationId}/service-accounts on a self-hosted Bitwarden instance where the org has exhausted its allocated service-account slots and the new account would exceed the limit.

Common situations: Self-hosted deployment with a fixed SM subscription; org has used all purchased service-account seats and the admin tries to add more via API without first upgrading the license.

Related errors

• The maximum number of projects for this plan is ({max}).
• Resource not found.
• Machine account access must be Can read, write
• Failed to remove organization vault. Please contact support.
• Organization must have at least one confirmed owner.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/cc6565a4e234fe72. Report an issue: GitHub.