bitwarden/server · error · BadRequestException

Users invalid.

Error message

Users invalid.

What it means

Error "Users invalid." thrown in bitwarden/server.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:776

    [HttpPatch("restore")]
    [Obsolete("This endpoint is deprecated. Use PUT method instead")]
    [Authorize<ManageUsersRequirement>]
    public async Task<ListResponseModel<OrganizationUserBulkResponseModel>> PatchBulkRestoreAsync(Guid orgId, [FromBody] OrganizationUserBulkRequestModel model)
    {
        return await BulkRestoreAsync(orgId, model);
    }

    [HttpPut("enable-secrets-manager")]
    [Authorize<ManageUsersRequirement>]
    public async Task BulkEnableSecretsManagerAsync(Guid orgId,
        [FromBody] OrganizationUserBulkRequestModel model)
    {
        var orgUsers = (await _organizationUserRepository.GetManyAsync(model.Ids))
            .Where(ou => ou.OrganizationId == orgId && !ou.AccessSecretsManager).ToList();
        if (orgUsers.Count == 0)
        {
            throw new BadRequestException("Users invalid.");
        }

        var additionalSmSeatsRequired = await _countNewSmSeatsRequiredQuery.CountNewSmSeatsRequiredAsync(orgId, orgUsers.Count);
        if (additionalSmSeatsRequired > 0)
        {
            // Self-hosted instances can't autoscale their Stripe subscription, so reject before touching billing.
            if (_globalSettings.SelfHosted)
            {
                throw new BadRequestException(new V2_UpdateUserCommand.CannotAutoscaleSecretsManagerSeatsOnSelfHost().Message);
            }

            var organization = await _organizationRepository.GetByIdAsync(orgId);
            var plan = await _pricingClient.GetPlanOrThrow(organization!.PlanType);
            var update = new SecretsManagerSubscriptionUpdate(organization, plan, true)
                .AdjustSeats(additionalSmSeatsRequired);
            await _updateSecretsManagerSubscriptionCommand.UpdateSubscriptionAsync(update);
        }

View on GitHub (pinned to e93b962371)

Solutions

1. Verify every user ID in the bulk request exists in the organization; remove stale or malformed IDs.
2. Fetch the current member list and rebuild the request payload from it.

When it happens

Trigger: Thrown when a bulk organization user operation receives one or more user IDs that are invalid, do not belong to the organization, or cannot be processed.

Common situations: See trigger scenarios.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/daa7d283079dc0e3. Report an issue: GitHub.