bitwarden/server · error · BadRequestException

You can only move up to 500 items at a time.

Error message

You can only move up to 500 items at a time.

What it means

Error "You can only move up to 500 items at a time." thrown in bitwarden/server.

Source

Thrown at src/Api/Vault/Controllers/CiphersController.cs:1211

        if (model.OrganizationId == default || !await CanDeleteOrRestoreCipherAsAdminAsync(model.OrganizationId, cipherIdsToRestore))
        {
            throw new NotFoundException();
        }

        var userId = _userService.GetProperUserId(User).Value;

        var restoredCiphers = await _cipherService.RestoreManyAsync(cipherIdsToRestore, userId, model.OrganizationId, true);
        var responses = restoredCiphers.Select(c => new CipherMiniResponseModel(c, _globalSettings, c.OrganizationUseTotp));
        return new ListResponseModel<CipherMiniResponseModel>(responses);
    }

    [HttpPut("move")]
    public async Task MoveMany([FromBody] CipherBulkMoveRequestModel model)
    {
        if (!_globalSettings.SelfHosted && model.Ids.Count() > 500)
        {
            throw new BadRequestException("You can only move up to 500 items at a time.");
        }

        var userId = _userService.GetProperUserId(User).Value;
        await _cipherService.MoveManyAsync(model.Ids.Select(i => new Guid(i)),
            string.IsNullOrWhiteSpace(model.FolderId) ? (Guid?)null : new Guid(model.FolderId), userId);
    }

    [HttpPost("move")]
    [Obsolete("This endpoint is deprecated. Use PUT method instead.")]
    public async Task PostMoveMany([FromBody] CipherBulkMoveRequestModel model)
    {
        await MoveMany(model);
    }

    [HttpPut("share")]
    public async Task<ListResponseModel<CipherMiniResponseModel>> PutShareMany([FromBody] CipherBulkShareRequestModel model)
    {
        var organizationId = new Guid(model.Ciphers.First().OrganizationId);

View on GitHub (pinned to e93b962371)

Solutions

1. Split the move into batches of 500 items or fewer.
2. Move items folder-by-folder or collection-by-collection to stay under the limit.

When it happens

Trigger: Thrown when a move-to-organization request includes more than 500 cipher IDs in a single bulk move operation.

Common situations: See trigger scenarios.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/c9fda15758495178. Report an issue: GitHub.