bitwarden/server · error · BadRequestException

Failed to remove organization vault. Please contact support.

Error message

Failed to remove organization vault. Please contact support.

What it means

Thrown by RemoveOrganizationFromProvider when any required argument (provider, providerOrganization, organization) is null, or when providerOrganization.ProviderId does not equal provider.Id. This is a data-integrity guard ensuring the three entities are mutually consistent before detaching an org and resetting its Stripe billing. BadRequestException (HTTP 400); the message comes from the FailedToRemoveOrganizationFromProviderError error class.

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Providers/RemoveOrganizationFromProviderCommand.cs:71

        _stripeAdapter = stripeAdapter;
        _featureService = featureService;
        _providerBillingService = providerBillingService;
        _subscriberService = subscriberService;
        _hasConfirmedOwnersExceptQuery = hasConfirmedOwnersExceptQuery;
        _pricingClient = pricingClient;
    }

    public async Task RemoveOrganizationFromProvider(
        Provider provider,
        ProviderOrganization providerOrganization,
        Organization organization)
    {
        if (provider == null ||
            providerOrganization == null ||
            organization == null ||
            providerOrganization.ProviderId != provider.Id)
        {
            throw new BadRequestException(new FailedToRemoveOrganizationFromProviderError().Message);
        }

        if (!await _hasConfirmedOwnersExceptQuery.HasConfirmedOwnersExceptAsync(
                providerOrganization.OrganizationId,
                [],
                includeProvider: false))
        {
            throw new BadRequestException(new OrgMustHaveConfirmedOwner().Message);
        }

        var organizationOwnerEmails =
            (await _organizationRepository.GetOwnerEmailAddressesById(organization.Id)).ToList();

        organization.BillingEmail = organizationOwnerEmails.MinBy(email => email);

        await ResetOrganizationBillingAsync(organization, provider, organizationOwnerEmails);

        await _organizationRepository.ReplaceAsync(organization);

View on GitHub (pinned to e93b962371)

Solutions

Fetch provider, providerOrganization, and organization from a single authoritative source and assert providerOrganization.ProviderId == provider.Id before calling.
Null-check all three entities in the caller before invocation.
Handle the race gracefully (treat already-removed as success) if appropriate.

Example fix

// before
await _removeOrgCommand.RemoveOrganizationFromProvider(provider, providerOrg, org);

// after
if (provider is null || providerOrg is null || org is null || providerOrg.ProviderId != provider.Id)
    return; // already removed or inconsistent
await _removeOrgCommand.RemoveOrganizationFromProvider(provider, providerOrg, org);

Defensive patterns

Strategy: validation

Validate before calling

if (provider is null || providerOrganization is null || organization is null
    || providerOrganization.ProviderId != provider.Id)
    throw new InvalidOperationException("Provider, providerOrganization, and organization must be non-null and consistent.");

Try / catch

try { await _removeOrgCommand.RemoveOrganizationFromProvider(provider, providerOrg, org); }
catch (BadRequestException ex) when (ex.Message.Contains("Failed to remove"))
{ /* inconsistent or missing entities; re-fetch and retry */ }

Prevention

Fetch all three entities from the same source in one request scope.
Assert ProviderId consistency before calling.
Handle the already-removed race as a no-op.

When it happens

Trigger: Calling RemoveOrganizationFromProvider with entities fetched from mismatched sources (providerOrganization belongs to a different provider), or when one of the lookups upstream returned null.

Common situations: Race condition where the providerOrganization was already deleted; stale cached IDs; provider from one request context and providerOrganization from another.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/fd37eb4722250624. Report an issue: GitHub.