bitwarden/server · error · BadRequestException

Machine account access must be Can read, write

Error message

Machine account access must be Can read, write

What it means

Thrown by ToServiceAccountPeopleAccessPolicies when at least one access policy in the request does not have both Read=true AND Write=true. Service account people (user/group) access policies must be full read-write — partial or read-only access is not permitted when assigning people to a service account. The guard is !policies.All(ap => ap.Read && ap.Write).

Source

Thrown at src/Api/SecretsManager/Models/Request/PeopleAccessPoliciesRequestModel.cs:71

        var groupAccessPolicies = GroupAccessPolicyRequests?
            .Select(x => x.ToGroupServiceAccountAccessPolicy(grantedServiceAccountId, organizationId)).ToList();

        var policies = new List<BaseAccessPolicy>();
        if (userAccessPolicies != null)
        {
            policies.AddRange(userAccessPolicies);
        }

        if (groupAccessPolicies != null)
        {
            policies.AddRange(groupAccessPolicies);
        }

        AccessPolicyHelpers.CheckForDistinctAccessPolicies(policies);

        if (!policies.All(ap => ap.Read && ap.Write))
        {
            throw new BadRequestException("Machine account access must be Can read, write");
        }

        return new ServiceAccountPeopleAccessPolicies
        {
            Id = grantedServiceAccountId,
            OrganizationId = organizationId,
            UserAccessPolicies = userAccessPolicies,
            GroupAccessPolicies = groupAccessPolicies
        };
    }
}

View on GitHub (pinned to e93b962371)

Solutions

1. Set both Read=true and Write=true on every user and group access policy in the request body.
2. If read-only access is truly needed, note that service account people policies do not support it — redesign the access model.
3. Validate all policy entries client-side before submission to ensure both flags are true.

Example fix

// before: read-only policy rejected
{
  "groupAccessPolicyRequests": [{
    "groupId": "...",
    "read": true,
    "write": false
  }]
}
// after: both read and write required
{
  "groupAccessPolicyRequests": [{
    "groupId": "...",
    "read": true,
    "write": true
  }]
}

// Validate all service-account people policies are read+write before submitting
var allPolicies = userPolicies.Concat(groupPolicies);
if (!allPolicies.All(ap => ap.Read && ap.Write))
{
    return BadRequest("All service account people access must be Read=true and Write=true.");
}
await client.SetServiceAccountPeoplePoliciesAsync(serviceAccountId, request);

static bool IsValidServiceAccountPeoplePolicy(AccessPolicyRequest p) => p.Read && p.Write;

try { await client.SetPoliciesAsync(id, req); }
catch (ApiException ex) when (ex.Message.Contains("Can read, write"))
{
    // Fix all policies to read+write and retry
    req.UserAccessPolicyRequests.ForEach(p => { p.Read = true; p.Write = true; });
    await client.SetPoliciesAsync(id, req);
}

When it happens

Trigger: POST/PUT to a service-account people access policies endpoint where any user or group access policy request has Read=false or Write=false (e.g., setting a group to read-only on a service account).

Common situations: UI or API client reuses project-access-policy patterns (which allow read-only) for service-account assignments; importing access policy templates that set Read=true, Write=false.

Related errors

• Resources must be unique
• Resources must be Read = true
• No version IDs provided.
• Last synced date must be in the past.
• Only service accounts can sync secrets.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/c127b2bd70ac81e6. Report an issue: GitHub.