bitwarden/server · warning · BadRequestException

You can only delete up to 500 items at a time. Consider usin

Error message

You can only delete up to 500 items at a time. Consider using the "Purge Vault" option instead.

What it means

DELETE /ciphers (DeleteMany, bulk permanent delete) rejects more than 500 ids on non-self-hosted (cloud) deployments. Self-hosted instances skip the check. Exceeding it returns HTTP 400 and suggests using 'Purge Vault' instead.

Source

Thrown at src/Api/Vault/Controllers/CiphersController.cs:972

            throw new NotFoundException();
        }

        await _cipherService.DeleteAsync(new CipherDetails(cipher), userId, true);
    }

    [HttpPost("{id}/delete-admin")]
    [Obsolete("This endpoint is deprecated. Use DELETE method instead.")]
    public async Task PostDeleteAdmin(Guid id)
    {
        await DeleteAdmin(id);
    }

    [HttpDelete("")]
    public async Task DeleteMany([FromBody] CipherBulkDeleteRequestModel model)
    {
        if (!_globalSettings.SelfHosted && model.Ids.Count() > 500)
        {
            throw new BadRequestException("You can only delete up to 500 items at a time. " +
                "Consider using the \"Purge Vault\" option instead.");
        }

        var userId = _userService.GetProperUserId(User).Value;
        await _cipherService.DeleteManyAsync(model.Ids.Select(i => new Guid(i)), userId);
    }

    [HttpPost("delete")]
    [Obsolete("This endpoint is deprecated. Use DELETE method instead.")]
    public async Task PostDeleteMany([FromBody] CipherBulkDeleteRequestModel model)
    {
        await DeleteMany(model);
    }

    [HttpDelete("admin")]
    public async Task DeleteManyAdmin([FromBody] CipherBulkDeleteRequestModel model)
    {
        if (!_globalSettings.SelfHosted && model.Ids.Count() > 500)

View on GitHub (pinned to e93b962371)

Solutions

1. Chunk the id list into batches of <= 500 and issue multiple DELETE calls.
2. For emptying the whole vault, use the Purge Vault option instead of bulk delete.
3. Surface the 500-item limit in the UI before triggering bulk delete.

Example fix

// before
DELETE /ciphers  body: { "ids": [/* 800 ids */] }
// after
DELETE /ciphers  body: { "ids": first500 }
DELETE /ciphers  body: { "ids": remaining300 }

const DELETE_LIMIT = 500;
async function bulkDelete(ids) {
  for (const chunk of chunkBy(ids, DELETE_LIMIT)) {
    await api.delete('/ciphers', { data: { ids: chunk } });
  }
}

function isWithinBulkLimit(ids: unknown[], limit = 500): boolean {
  return Array.isArray(ids) && ids.length <= limit;
}

When it happens

Trigger: A bulk DELETE /ciphers whose `Ids` contains more than 500 entries on a cloud deployment.

Common situations: A 'select all + delete' UI over a large vault; a teardown script deleting many items at once; not chunking bulk deletes.

Related errors

• You can only delete up to 500 items at a time.
• You can only archive up to 500 items at a time.
• You can only unarchive up to 500 items at a time.
• No ciphers were archived. Ensure the provided IDs are correc
• Cipher was not encrypted for the current user. Please try ag

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/21ca503cc12278d1. Report an issue: GitHub.