bitwarden/server · error · BadRequestException

Not enough privileges to import into this organization.

Error message

Not enough privileges to import into this organization.

What it means

Thrown by PostImportOrganization when CheckOrgImportPermissionAsync returns false — the caller lacks sufficient privileges to import into the target organization. Permission is granted if the user has AccessImportExport, or if they can create collections (for new collections) and/or import ciphers into existing collections (BulkCollectionOperations.ImportCiphers). None of those conditions were met.

Source

Thrown at src/Api/Tools/Controllers/ImportCiphersController.cs:83

    {
        if (!_globalSettings.SelfHosted &&
            (model.Ciphers.Length > _globalSettings.ImportCiphersLimitation.CiphersLimit ||
             model.CollectionRelationships.Length > _globalSettings.ImportCiphersLimitation.CollectionRelationshipsLimit ||
             model.Collections.Length > _globalSettings.ImportCiphersLimitation.CollectionsLimit ||
             model.Folders.Length > _globalSettings.ImportCiphersLimitation.FoldersLimit ||
             model.FolderRelationships.Length > _globalSettings.ImportCiphersLimitation.FolderRelationshipsLimit))
        {
            throw new BadRequestException("You cannot import this much data at once.");
        }

        var orgId = new Guid(organizationId);
        var collections = model.Collections.Select(c => c.ToCollection(orgId)).ToList();

        // A User is allowed to import if CanCreate Collections or has AccessToImportExport
        var authorized = await CheckOrgImportPermissionAsync(collections, orgId);
        if (!authorized)
        {
            throw new BadRequestException("Not enough privileges to import into this organization.");
        }

        var userId = _userService.GetProperUserId(User) ?? throw new InvalidOperationException("User ID not found");
        var ciphers = model.Ciphers.Select(l => l.ToOrganizationCipherDetails(orgId)).ToList();
        var folders = model.Folders.Select(f => f.ToFolder(userId)).ToList();
        await _importCiphersCommand.ImportIntoOrganizationalVaultAsync(collections, ciphers, model.CollectionRelationships, userId, folders, model.FolderRelationships);
    }

    private async Task<bool> CheckOrgImportPermissionAsync(List<Collection> collections, Guid orgId)
    {
        //Users are allowed to import if they have the AccessToImportExport permission
        if (await _currentContext.AccessImportExport(orgId))
        {
            return true;
        }

        //Calling Repository instead of Service as we want to get all the collections, regardless of permission
        //Permissions check will be done later on AuthorizationService

View on GitHub (pinned to e93b962371)

Solutions

1. Have an org admin grant the user the 'Access Import/Export' permission or a custom role with import privileges.
2. Ensure the user has CreateCollection permission if the import includes new collections, or ImportCiphers permission for existing collections.
3. If importing into existing collections only, confirm the user has manage or import access on all target collections.
4. Perform the import as an org admin if role delegation is not feasible.

// Verify import permissions before calling the endpoint
if (!await currentContext.AccessImportExport(orgId)
    && !await authService.AuthorizeAsync(User, collections, BulkCollectionOperations.Create) &&
    && !await authService.AuthorizeAsync(User, existingCollections, BulkCollectionOperations.ImportCiphers))
{
    return Forbid("Not enough privileges to import into this organization.");
}
await importClient.ImportOrganizationAsync(orgId, model);

try { await client.ImportOrganizationAsync(orgId, model); }
catch (ApiException ex) when (ex.Message.Contains("Not enough privileges"))
{
    // Prompt user to request AccessImportExport or collection permissions from admin
    NotifyUser("Contact an org admin to grant import permissions.");
}

When it happens

Trigger: POST /ciphers/import-organization by a user who is not an org admin, does not have the AccessImportExport permission, and does not have collection-create or collection-import permissions on the target collections.

Common situations: A standard org member tries to import into an org vault without delegated import privileges; a custom role lacks the Import/Export permission; the user can manage some collections but the import includes new collections they cannot create.

Related errors

• Invalid permissions.
• You cannot import this much data at once.
• Resource not found.
• Failed to remove organization vault. Please contact support.
• Organization must have at least one confirmed owner.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/bf4effade28fd0e4. Report an issue: GitHub.