bitwarden/server · error · BadRequestException

The organization is subscribed to Secrets Manager. Please co

Error message

The organization is subscribed to Secrets Manager. Please contact Customer Support to manage the subscription.

What it means

Thrown by ProviderService.AddOrganization after the org is confirmed unlinked and plan types are validated, when organization.UseSecretsManager is true. Provider-managed orgs that already have a Secrets Manager subscription cannot be added directly; support must handle the subscription migration. BadRequestException (HTTP 400).

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:449

    }

    public async Task AddOrganization(Guid providerId, Guid organizationId, string key)
    {
        var po = await _providerOrganizationRepository.GetByOrganizationId(organizationId);
        if (po != null)
        {
            throw new BadRequestException("Organization already belongs to a provider.");
        }

        var organization = await _organizationRepository.GetByIdAsync(organizationId);

        var provider = await _providerRepository.GetByIdAsync(providerId);

        ThrowOnInvalidPlanType(provider.Type, organization.PlanType);

        if (organization.UseSecretsManager)
        {
            throw new BadRequestException(
                "The organization is subscribed to Secrets Manager. Please contact Customer Support to manage the subscription.");
        }

        var providerOrganization = new ProviderOrganization
        {
            ProviderId = providerId,
            OrganizationId = organizationId,
            Key = key,
        };

        await ApplyProviderPriceRateAsync(organization, provider);
        await _providerOrganizationRepository.CreateAsync(providerOrganization);

        organization.BillingEmail = provider.BillingEmail;
        await _organizationRepository.ReplaceAsync(organization);

        if (!string.IsNullOrEmpty(organization.GatewayCustomerId))
        {

View on GitHub (pinned to e93b962371)

Solutions

1. Contact Customer Support to migrate/cancel the Secrets Manager subscription before provider-adding the org.
2. If programmatic, check organization.UseSecretsManager first and route to a support workflow instead of AddOrganization.
3. Confirm with billing whether the provider plan includes SM before attempting the add.

Example fix

// before
await providerService.AddOrganization(providerId, orgId, key);

// after
if (organization.UseSecretsManager)
{
    return RedirectToSupport("Secrets Manager subscription migration required.");
}
await providerService.AddOrganization(providerId, orgId, key);

if (organization.UseSecretsManager) { /* route to support, do not call AddOrganization */ }

static bool HasSecretsManager(Organization org) => org.UseSecretsManager;

When it happens

Trigger: Adding an organization that has UseSecretsManager enabled (active Secrets Manager add-on) to a provider via AddOrganization.

Common situations: An enterprise org that purchased Secrets Manager standalone is later moved under a provider; the SM subscription must be reconciled by support before the provider link is created.

Related errors

• Managed Service Providers cannot manage organizations with t
• Business Unit Providers cannot manage organizations with the
• Providers cannot manage organizations with the requested pla
• Provider plan not found.
• Failed to remove organization vault. Please contact support.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/d57cb271a2356a33. Report an issue: GitHub.