bitwarden/server · error · BadRequestException

Max file size is 500 MB.

Error message

Max file size is 500 MB.

What it means

Thrown by POST /reports/organizations/{organizationId} when the AccessIntelligenceNewArchitecture feature flag is enabled AND the request body's FileSize exceeds Constants.FileSize501mb (the 500 MB cap). FileSize is a client-claimed value used to provision blob upload; the actual file is uploaded separately to the upload endpoint which carries its own RequestSizeLimit. This gate prevents creating a report for a file that can never be accepted.

Source

Thrown at src/Api/Dirt/Controllers/OrganizationReportsController.cs:115

        EnsureValidIds(organizationId);

        await AuthorizeAsync(organizationId);

        // File storage only exists under the new architecture, so gate the file path on the (stable)
        // AccessIntelligenceNewArchitecture flag. Within that, select the path from the request shape
        // rather than the file-storage flag (AccessIntelligenceVersion2): the client chooses its shape
        // from that flag via a config cache that can lag the server by up to an hour (pronounced in
        // self-hosted), so branching on it here would 500 whenever the two disagree. Honoring the shape
        // lets file-storage flag staleness degrade gracefully.
        var isNewArchitecture = _featureService.IsEnabled(FeatureFlagKeys.AccessIntelligenceNewArchitecture);
        if (isNewArchitecture && request.FileSize.HasValue)
        {
            // This caps the claimed file-size value only. The file itself is uploaded separately to
            // blob storage via UploadReportFileAsync, so no large body flows through this endpoint and
            // no request-body size limit belongs here (that limit lives on the upload endpoint).
            if (request.FileSize.Value > Constants.FileSize501mb)
            {
                throw new BadRequestException("Max file size is 500 MB.");
            }

            var report = await _createReportCommand.CreateAsync(request.ToData(organizationId));
            var fileData = report.GetReportFile()!;
            var reportFileUploadUrl = await _storageService.GetReportFileUploadUrlAsync(report, fileData);

            return Ok(new OrganizationReportFileResponseModel
            {
                ReportFileUploadUrl = reportFileUploadUrl,
                ReportResponse = new OrganizationReportResponseModel(report),
                FileUploadType = _storageService.FileUploadType
            });
        }

        var v1Report = await _addOrganizationReportCommand.AddOrganizationReportAsync(request.ToData(organizationId));
        var response = v1Report == null ? null : new OrganizationReportResponseModel(v1Report);
        return Ok(response);
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Reduce the report payload to under 500 MB before creating the report.
2. If the source data is larger, split it into multiple reports or compress before reporting FileSize.
3. Verify the client is setting FileSize in bytes and not accidentally doubling or adding units.

Example fix

// before
var req = new AddOrganizationReportRequestModel { FileSize = rawBytes /* could exceed cap */ };
// after
const long Max = 500L * 1024 * 1024;
if (rawBytes > Max) throw new InvalidOperationException("Report too large; split or compress.");
var req = new AddOrganizationReportRequestModel { FileSize = rawBytes };

const long MaxFileSize = 500L * 1024 * 1024; // mirror server cap
if (request.FileSize.HasValue && request.FileSize.Value > MaxFileSize)
    throw new InvalidOperationException("Report file exceeds the 500 MB server cap; split or compress.");

try { var resp = await client.PostAsync(createUrl, json); }
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest && ex.Message.Contains("Max file size"))
{ /* reduce payload and retry */ }

When it happens

Trigger: Client sends AddOrganizationReportRequestModel with FileSize > ~525,336,576 bytes (500 MiB + 1 MiB constant) while new architecture is on. Note FileSize must have a value (HasValue); if null the inline-data path is taken instead.

Common situations: Client computes FileSize incorrectly (e.g. reports bytes vs MB, or includes padding); very large risk-intelligence export exceeds the cap; feature flag flipped on for an org whose client wasn't updated to chunk uploads.

Related errors

• ReportFileId is required.
• Resource not found.
• Invalid content.
• ReportFileId query parameter is required
• File received does not match expected constraints.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/983e0d48e331bebc. Report an issue: GitHub.