bitwarden/server · error · BadRequestException

To grant PAM access the organization must have PAM enabled.

Error message

To grant PAM access the organization must have PAM enabled.

What it means

Error "To grant PAM access the organization must have PAM enabled." thrown in bitwarden/server.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:824

    /// </summary>
    [HttpPut("enable-pam")]
    [Authorize<ManageUsersRequirement>]
    public async Task BulkEnablePamAsync(Guid orgId,
        [FromBody] OrganizationUserBulkRequestModel model)
    {
        var orgUsers = (await _organizationUserRepository.GetManyAsync(model.Ids))
            .Where(ou => ou.OrganizationId == orgId && !ou.AccessPam).ToList();
        if (orgUsers.Count == 0)
        {
            throw new BadRequestException(new UsersInvalid().Message);
        }

        // Granting access on an organization without PAM would be inert: claim emission ANDs AccessPam with the
        // organization's UsePam.
        var organization = await _organizationRepository.GetByIdAsync(orgId);
        if (organization is not { UsePam: true })
        {
            throw new BadRequestException(new V2_UpdateUserCommand.PamNotEnabled().Message);
        }

        foreach (var orgUser in orgUsers)
        {
            orgUser.AccessPam = true;
        }

        await _organizationUserRepository.ReplaceManyAsync(orgUsers);
    }

    [HttpPost("{id}/auto-confirm")]
    [Authorize<ManageUsersRequirement>]
    public async Task<IResult> AutomaticallyConfirmOrganizationUserAsync([FromRoute] Guid orgId,
        [FromRoute] Guid id,
        [FromBody] OrganizationUserConfirmRequestModel model)
    {
        var userId = _userService.GetProperUserId(User);

View on GitHub (pinned to e93b962371)

Solutions

1. Enable PAM for the organization in the billing/subscription settings before granting PAM access.
2. Contact Bitwarden support or your account manager to add PAM to the organization's plan.

When it happens

Trigger: Thrown when attempting to grant a user PAM access for an organization that does not have the PAM feature enabled on its plan.

Common situations: See trigger scenarios.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/bec8db965355b196. Report an issue: GitHub.