bitwarden/server · error · BadRequestException

Invalid owner. Owner must be an existing Bitwarden user.

Error message

Invalid owner. Owner must be an existing Bitwarden user.

What it means

Thrown by the private CreateProviderAsync helper (used by CreateMspAsync and CreateBusinessUnitAsync) when IUserRepository.GetByEmailAsync(ownerEmail) returns null. A provider's owner must already be a registered Bitwarden user because a ProviderUser record (ProviderAdmin / Confirmed) is immediately created and bound to that user's Id. This is a BadRequestException mapping to HTTP 400.

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Providers/CreateProviderCommand.cs:63

    public async Task CreateResellerAsync(Provider provider)
    {
        await ProviderRepositoryCreateAsync(provider, ProviderStatusType.Created);
    }

    public async Task CreateBusinessUnitAsync(Provider provider, string ownerEmail, PlanType plan, int minimumSeats)
    {
        var providerId = await CreateProviderAsync(provider, ownerEmail);

        await CreateProviderPlanAsync(providerId, plan, minimumSeats);
    }

    private async Task<Guid> CreateProviderAsync(Provider provider, string ownerEmail)
    {
        var owner = await _userRepository.GetByEmailAsync(ownerEmail);
        if (owner == null)
        {
            throw new BadRequestException("Invalid owner. Owner must be an existing Bitwarden user.");
        }

        provider.Gateway = GatewayType.Stripe;

        await ProviderRepositoryCreateAsync(provider, ProviderStatusType.Pending);

        var providerUser = new ProviderUser
        {
            ProviderId = provider.Id,
            UserId = owner.Id,
            Type = ProviderUserType.ProviderAdmin,
            Status = ProviderUserStatusType.Confirmed,
        };

        await _providerUserRepository.CreateAsync(providerUser);
        await _providerService.SendProviderSetupInviteEmailAsync(provider, owner.Email);

        return provider.Id;

View on GitHub (pinned to e93b962371)

Solutions

1. Verify the owner exists first: call _userRepository.GetByEmailAsync(ownerEmail) and confirm non-null before invoking the command.
2. Register/provision the user account before attempting provider creation.
3. Check you are pointed at the correct environment/database (dev vs staging).

Example fix

// before
await _createProviderCommand.CreateMspAsync(provider, "notarealuser@example.com", 10, 10);

// after
var owner = await _userRepository.GetByEmailAsync(ownerEmail);
if (owner == null) throw new InvalidOperationException($"Owner {ownerEmail} is not a registered user.");
await _createProviderCommand.CreateMspAsync(provider, ownerEmail, 10, 10);

var owner = await _userRepository.GetByEmailAsync(ownerEmail);
if (owner == null)
    throw new InvalidOperationException($"No Bitwarden user found for owner email '{ownerEmail}'.");

try { await _createProviderCommand.CreateMspAsync(provider, ownerEmail, teams, enterprise); }
catch (BadRequestException ex) when (ex.Message.Contains("Invalid owner"))
{ /* surface: owner email is not a registered user */ }

When it happens

Trigger: Calling CreateMspAsync or CreateBusinessUnitAsync with an ownerEmail that has no matching row in the Users table (typo, unregistered address, or wrong environment database).

Common situations: Seeding/automation scripts that reference an email not yet provisioned; integration tests against a fresh database; admin typos; email case differences depending on database collation.

Related errors

• Invalid owner.
• Failed to remove organization vault. Please contact support.
• Organization must have at least one confirmed owner.
• User invalid.
• Invite the user first.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/a1badbb4bc53a25d. Report an issue: GitHub.