bitwarden/server · error · BadRequestException

Invalid permissions.

Error message

Invalid permissions.

What it means

Thrown inside ResendInvitesAsync as BadRequestException when _currentContext.ProviderManageUsers(invite.ProviderId) returns false — the caller lacks permission to manage users for that provider. BadRequestException (HTTP 400).

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:223

                RevisionDate = DateTime.UtcNow,
            };

            await _providerUserRepository.CreateAsync(providerUser);

            await SendInviteAsync(providerUser, provider);
            providerUsers.Add(providerUser);
        }

        await _eventService.LogProviderUsersEventAsync(providerUsers.Select(pu => (pu, EventType.ProviderUser_Invited, null as DateTime?)));

        return providerUsers;
    }

    public async Task<List<Tuple<ProviderUser, string>>> ResendInvitesAsync(ProviderUserInvite<Guid> invite)
    {
        if (!_currentContext.ProviderManageUsers(invite.ProviderId))
        {
            throw new BadRequestException("Invalid permissions.");
        }

        var providerUsers = await _providerUserRepository.GetManyAsync(invite.UserIdentifiers);
        var provider = await _providerRepository.GetByIdAsync(invite.ProviderId);

        var result = new List<Tuple<ProviderUser, string>>();
        foreach (var providerUser in providerUsers)
        {
            if (providerUser.Status != ProviderUserStatusType.Invited || providerUser.ProviderId != invite.ProviderId)
            {
                result.Add(Tuple.Create(providerUser, "User invalid."));
                continue;
            }

            await SendInviteAsync(providerUser, provider);
            result.Add(Tuple.Create(providerUser, ""));
        }

View on GitHub (pinned to e93b962371)

Solutions

1. Verify _currentContext.ProviderManageUsers(providerId) is true before calling.
2. Ensure the caller holds a ProviderAdmin (or equivalent) role with user-management rights for that provider.
3. Refresh the session/permission claims if they are stale.

if (!_currentContext.ProviderManageUsers(invite.ProviderId))
    throw new UnauthorizedAccessException("Caller lacks ProviderManageUsers permission.");

try { await _providerService.ResendInvitesAsync(invite); }
catch (BadRequestException ex) when (ex.Message == "Invalid permissions.")
{ /* refresh session / re-check role */ }

When it happens

Trigger: A provider user without manage-users rights calls resend invites; the current context's provider Id does not match; session permission claims expired.

Common situations: Role downgrade after page load; cross-provider request with the wrong provider context; expired or stale session token.

Related errors

• An organization the user is a part of has enabled Automatic
• User invalid.
• Already accepted.
• User email does not match invite.
• Not enough privileges to import into this organization.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/eb25509ff3b95beb. Report an issue: GitHub.