bitwarden/server · error · BadRequestException

You cannot delete accounts owned by an organization. Contact

Error message

You cannot delete accounts owned by an organization. Contact your admin for additional details.

What it means

In DELETE /accounts, after secret verification passes, if _userService.IsClaimedByAnyOrganizationAsync(user.Id) is true the controller throws BadRequestException with the CannotDeleteClaimedAccountError message → HTTP 400. Users claimed by an organization (managed/owned accounts) cannot self-delete and must contact their admin.

Source

Thrown at src/Api/Auth/Controllers/AccountsController.cs:589

    public async Task Delete([FromBody] SecretVerificationRequestModel model)
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new UnauthorizedAccessException();
        }

        if (!await _userService.VerifySecretAsync(user, model.Secret))
        {
            ModelState.AddModelError(string.Empty, "User verification failed.");
            await Task.Delay(2000);
        }
        else
        {
            // Check if the user is claimed by any organization.
            if (await _userService.IsClaimedByAnyOrganizationAsync(user.Id))
            {
                throw new BadRequestException(new CannotDeleteClaimedAccountError().Message);
            }

            var result = await _userService.DeleteAsync(user);
            if (result.Succeeded)
            {
                return;
            }

            foreach (var error in result.Errors)
            {
                ModelState.AddModelError(string.Empty, error.Description);
            }
        }

        throw new BadRequestException(ModelState);
    }

    [HttpPost("delete")]

View on GitHub (pinned to e93b962371)

Solutions

1. Direct the user to contact their organization administrator to remove or release the account.
2. If the claim is stale, have an admin unclaim the user in the admin console first, then retry.
3. Use the organization-level offboarding/removal path instead of self-service delete.
4. Confirm via GetOrganizationIdsClaimingUser whether the user is actually claimed before attempting delete.

Example fix

// before
await client.DeleteAsync("accounts"); // 400 claimed
// after
var claiming = await GetClaimingOrgsAsync(user);
if (claiming.Any()) PromptContactAdmin(claiming);
else await client.DeleteAsync("accounts");

// Check claim status before attempting self-delete
var claiming = await GetOrganizationIdsClaimingUserAsync(userId);
if (claiming.Any()) return; // cannot self-delete

static bool CanSelfDelete(IReadOnlyList<Guid> claimingOrgs) => claimingOrgs is null || claimingOrgs.Count == 0;

try { await client.DeleteAsync("accounts"); }
catch (BadRequestException ex) when (ex.Message.Contains("claimed"))
{ PromptContactAdmin(); }

When it happens

Trigger: An organization-managed user (e.g. claimed via directory or enterprise ownership) attempts to delete their own account through DELETE /accounts.

Common situations: Enterprise/Teams member whose account is organization-owned; user provisioned by SCIM/directory and marked as claimed; user left an org but the claim record persists; org enabled account-claiming via policies.

Related errors

• All existing reset password keys must be included in the rot
• Failed to remove organization vault. Please contact support.
• Organization must have at least one confirmed owner.
• Organization already belongs to a provider.
• One or more collections do not belong to this organization.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/091ecb7ee06f12e0. Report an issue: GitHub.