bitwarden/server · error · BadRequestException

Resources must be Read = true

Error message

Resources must be Read = true

What it means

Thrown by AccessPolicyHelpers.CheckAccessPoliciesHaveReadPermission when at least one access policy in the collection has Read=false. This helper is called when creating project people access policies (ToProjectPeopleAccessPolicies). Every policy must grant at least read permission; write-only or no-access entries are rejected.

Source

Thrown at src/Api/SecretsManager/Utilities/AccessPolicyHelpers.cs:41

                    ap.GrantedProjectId),
                ServiceAccountSecretAccessPolicy ap => new Tuple<Guid?, Guid?>(ap.ServiceAccountId,
                    ap.GrantedSecretId),
                _ => throw new ArgumentException("Unsupported access policy type provided.", nameof(baseAccessPolicy)),
            };
        }).ToList();

        if (accessPolicies.Count != distinctAccessPolicies.Count)
        {
            throw new BadRequestException("Resources must be unique");
        }
    }

    public static void CheckAccessPoliciesHaveReadPermission(IEnumerable<BaseAccessPolicy> accessPolicies)
    {
        var accessPoliciesPermission = accessPolicies.All(policy => policy.Read);
        if (!accessPoliciesPermission)
        {
            throw new BadRequestException("Resources must be Read = true");
        }
    }
}

View on GitHub (pinned to e93b962371)

Solutions

1. Ensure every access policy in the request has Read=true.
2. If the intent is to revoke access, remove the policy entry entirely rather than setting Read=false.
3. Validate all policy entries have Read=true before submission.

Example fix

// before: write-only, no read
{
  "userAccessPolicyRequests": [{
    "organizationUserId": "...",
    "read": false,
    "write": true
  }]
}
// after: read required
{
  "userAccessPolicyRequests": [{
    "organizationUserId": "...",
    "read": true,
    "write": true
  }]
}

// Ensure all policies have Read=true before submission
if (!policies.All(p => p.Read))
{
    return BadRequest("All access policies must have Read=true.");
}
await client.SetProjectPeoplePoliciesAsync(projectId, request);

static bool AllPoliciesHaveRead(IEnumerable<BaseAccessPolicy> policies)
    => policies.All(p => p.Read);

try { await client.SetPoliciesAsync(id, req); }
catch (ApiException ex) when (ex.Message.Contains("Read = true"))
{
    req.Policies.ForEach(p => p.Read = true);
    await client.SetPoliciesAsync(id, req);
}

When it happens

Trigger: A project people access policies request includes a user or group access policy with Read=false (and possibly Write=true), which is logically invalid — you cannot grant write without read.

Common situations: A client sends a policy with read=false, write=true by mistake; importing a policy set where some entries were intended for removal (read=false) rather than grant.

Related errors

• Machine account access must be Can read, write
• Resources must be unique
• No version IDs provided.
• Last synced date must be in the past.
• Only service accounts can sync secrets.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/8abe8e4c58a225ac. Report an issue: GitHub.