bitwarden/server · error · BadRequestException

Name is required.

Error message

Name is required.

What it means

Thrown as a BadRequestException (HTTP 400) by AccessRuleWriteValidator.ValidateAsync when the AccessRule.Name is null, empty, or whitespace. Name is a mandatory field for all PAM access rules — it is the human-readable identifier shown in the admin UI and used in name-uniqueness checks.

Source

Thrown at bitwarden_license/src/Services/Pam/Services/AccessRuleWriteValidator.cs:34

    private readonly ICollectionRepository _collectionRepository;
    private readonly IAccessRuleValidator _conditionsValidator;

    public AccessRuleWriteValidator(
        IAccessRuleRepository repository,
        ICollectionRepository collectionRepository,
        IAccessRuleValidator conditionsValidator)
    {
        _repository = repository;
        _collectionRepository = collectionRepository;
        _conditionsValidator = conditionsValidator;
    }

    public async Task<List<Guid>> ValidateAsync(Guid organizationId, AccessRule rule,
        IEnumerable<Guid> collectionIds, Guid? existingRuleId = null)
    {
        if (string.IsNullOrWhiteSpace(rule.Name))
        {
            throw new BadRequestException("Name is required.");
        }

        if (rule.AllowsExtensions && rule.MaxExtensionDurationSeconds is not > 0)
        {
            throw new BadRequestException("A maximum extension length is required when extensions are allowed.");
        }

        var conditions = _conditionsValidator.Validate(rule.Conditions);
        if (!conditions.IsValid)
        {
            throw new BadRequestException(conditions.Error!);
        }

        await ValidateNameIsUniqueAsync(organizationId, rule.Name, existingRuleId);

        return await ValidateCollectionsAsync(organizationId, collectionIds, existingRuleId);
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Provide a non-empty, non-whitespace 'name' in the request body.
2. Add client-side validation to require name before submission.
3. If using PUT for a partial update, switch to PATCH or include the existing name.

Example fix

// before
//   { "conditions": {...}, "collectionIds": [...] }  // name missing
// after
//   { "name": "Engineering Access Rule", "conditions": {...}, "collectionIds": [...] }

if (string.IsNullOrWhiteSpace(rule.Name))
    throw new InvalidOperationException("AccessRule name is required");
// only then submit to API

try { await pamClient.CreateAccessRuleAsync(orgId, rule); }
catch (HttpRequestException ex) when (ex.Message.Contains("Name is required"))
{ /* ensure name is provided and retry */ }

When it happens

Trigger: Creating or updating a PAM AccessRule (POST or PUT to the access-rules endpoint) with a body where 'name' is omitted, null, empty, or only whitespace. Caused by a client omitting the field or sending an empty string.

Common situations: API client sends a partial update that omits name on a PUT (full replace) path. A UI form allows submission with an empty name field. Automated rule creation script has a null or empty name variable.

Related errors

• A maximum extension length is required when extensions are a
• conditions.Error!
• ExternalId cannot exceed 300 characters.
• ExternalId cannot exceed 300 characters.
• result.AsError.Message

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/cab56b091a67d653. Report an issue: GitHub.