bitwarden/server · error · BadRequestException

result.AsError.Message

Error message

result.AsError.Message

What it means

Thrown as a BadRequestException (HTTP 400) by PostUserCommand when the CreateStagedOrganizationUsersCommand returns an error result. The exception message is the dynamic result.AsError.Message from the staging command, so the specific cause varies. This is a passthrough of an internal creation-pipeline failure surfaced to the SCIM client as a 400.

Source

Thrown at bitwarden_license/src/Scim/Users/PostUserCommand.cs:85

            throw new ConflictException();
        }

        var organization = await organizationRepository.GetByIdAsync(organizationId);
        if (organization == null)
        {
            throw new NotFoundException();
        }

        var result = await createStagedOrganizationUsersCommand.RunAsync(new CreateStagedOrganizationUsersRequest
        {
            Organization = organization,
            Users = [new StagedOrganizationUserRequest { Email = email, ExternalId = externalId }],
            EventSystemUser = EventSystemUser.SCIM
        });

        if (result.IsError)
        {
            throw new BadRequestException(result.AsError.Message);
        }

        // The command skips emails already present in the organization, so an empty result means the user
        // was added by a concurrent request after the conflict check above.
        var stagedUser = result.AsSuccess.FirstOrDefault() ?? throw new ConflictException();

        return await organizationUserRepository.GetDetailsByIdAsync(stagedUser.Id);
    }

    private async Task<OrganizationUserUserDetails?> InviteScimOrganizationUserAsync_vNext(
        ScimUserRequestModel model,
        Guid organizationId,
        ScimProviderType scimProvider)
    {
        var organization = await organizationRepository.GetByIdAsync(organizationId);

        if (organization is null)
        {

View on GitHub (pinned to e93b962371)

Solutions

1. Read the dynamic message in the 400 response body — it contains the specific staging-command error.
2. Verify the organization has available seats and an active subscription.
3. Ensure the email is well-formed and not already present.
4. Check organization status (enabled, SCIM-capable plan) in the admin portal.
5. Retry after resolving the condition described in the error message.

try { var user = await scimClient.CreateUserAsync(orgId, model); }
catch (ScimException ex) when (ex.StatusCode == 400)
{ // read ex.Detail for the specific staging-command error
  logger.Error("User creation rejected: {Reason}", ex.Detail);
  // address the specific issue (seats, email, org state) before retry }

When it happens

Trigger: POST /v2/{organizationId}/Users where the internal staged-user creation pipeline rejects the request — e.g., invalid email format, organization not in a state that allows invites, seat limits exceeded, or other business-rule violations inside CreateStagedOrganizationUsersCommand.

Common situations: Organization has reached its seat limit. Email fails internal validation (malformed, blocked domain). Organization is disabled or not in a plan that supports SCIM. Internal command precondition fails.

Related errors

• ExternalId cannot exceed 300 characters.
• ExternalId cannot exceed 300 characters.
• User already exists.
• conditions.Error!
• Invalid owner. Owner must be an existing Bitwarden user.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/3da31ecf477b2d8c. Report an issue: GitHub.