bitwarden/server · error · BadRequestException

Cannot create a {typedModel.Type} connection outside of a se

Error message

Cannot create a {typedModel.Type} connection outside of a self-hosted instance.

What it means

Thrown by ValidateBillingSyncConfig (invoked during create/update of a CloudBillingSync connection) when _globalSettings.SelfHosted is false. Billing Sync is a self-hosted-only feature that syncs billing data to the cloud, so creating one on a cloud instance is invalid. This is a second-layer check (the feature also gates reads via error 150). Maps to HTTP 400.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs:199

    /// </remarks>
    private async Task<bool> HasPermissionAsync(Guid? organizationId, OrganizationConnectionType? type = null)
    {
        if (!organizationId.HasValue)
        {
            return false;
        }
        return type switch
        {
            OrganizationConnectionType.Scim => await _currentContext.ManageScim(organizationId.Value),
            _ => await _currentContext.OrganizationOwner(organizationId.Value),
        };
    }

    private async Task ValidateBillingSyncConfig(OrganizationConnectionRequestModel<BillingSyncConfig> typedModel)
    {
        if (!_globalSettings.SelfHosted)
        {
            throw new BadRequestException($"Cannot create a {typedModel.Type} connection outside of a self-hosted instance.");
        }
        var license = await _licensingService.ReadOrganizationLicenseAsync(typedModel.OrganizationId);

        if (license == null || !_licensingService.VerifyLicense(license))
        {
            throw new BadRequestException("Cannot verify license file.");
        }
        typedModel.ParsedConfig.CloudOrganizationId = license.Id;
    }

    private async Task<OrganizationConnectionResponseModel> CreateOrUpdateOrganizationConnectionAsync<T>(
        Guid? organizationConnectionId,
        OrganizationConnectionRequestModel model,
        Func<OrganizationConnectionRequestModel<T>, Task>? validateAction = null)
        where T : IConnectionConfig
    {
        var typedModel = new OrganizationConnectionRequestModel<T>(model);
        if (validateAction != null)

View on GitHub (pinned to e93b962371)

Solutions

1. Run against a self-hosted instance for any CloudBillingSync operation.
2. On a self-hosted install, set GlobalSettings.SelfHosted=true (env globalSettings__selfHosted=true or appsettings SelfHosted=true).
3. On cloud, do not attempt to create CloudBillingSync connections; use cloud billing endpoints.
4. Confirm EnableCloudCommunication is also true for the full feature.

Example fix

// appsettings.json or env — before
{ "globalSettings": { "selfHosted": false } }
// after
{ "globalSettings": { "selfHosted": true, "enableCloudCommunication": true } }

// CloudBillingSync create is self-hosted-only
var enabled = await client.GetAsync<bool>("organizations/connections/enabled");
if (!enabled && model.Type == OrganizationConnectionType.CloudBillingSync)
    throw new InvalidOperationException("CloudBillingSync requires a self-hosted instance with cloud communication enabled.");

When it happens

Trigger: POST or PUT /organizations/connections with type=CloudBillingSync (1) against a non-self-hosted deployment; the request passes the earlier permission/type checks but fails this config validator inside CreateOrUpdateOrganizationConnectionAsync.

Common situations: Dev/test running against the cloud API or a local server with SelfHosted unset; a misconfigured self-hosted install where the env var globalSettings__selfHosted is missing or false; environment promotion that dropped the setting.

Related errors

• Cannot get a {type} connection outside of a self-hosted inst
• Cannot verify license file.
• Unable to get Cloud Billing Sync connection
• HaveIBeenPwned API key not set.
• You do not have permission to create a connection of type {m

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/ee1bc5abd7aaeaa3. Report an issue: GitHub.