bitwarden/server · error · BadRequestException

You cannot delete accounts owned by an organization…

Error message

You cannot delete accounts owned by an organization. Contact your admin for additional details.

What it means

In DELETE /accounts, after secret verification passes, if _userService.IsClaimedByAnyOrganizationAsync(user.Id) is true the controller throws BadRequestException with the CannotDeleteClaimedAccountError message → HTTP 400. Users claimed by an organization (managed/owned accounts) cannot self-delete and must contact their admin.

Solutions

Direct the user to contact their organization administrator to remove or release the account.
If the claim is stale, have an admin unclaim the user in the admin console first, then retry.
Use the organization-level offboarding/removal path instead of self-service delete.
Confirm via GetOrganizationIdsClaimingUser whether the user is actually claimed before attempting delete.

Example fix

// before
await client.DeleteAsync("accounts"); // 400 claimed
// after
var claiming = await GetClaimingOrgsAsync(user);
if (claiming.Any()) PromptContactAdmin(claiming);
else await client.DeleteAsync("accounts");

Defensive patterns

Strategy: type-guard

Validate before calling

// Check claim status before attempting self-delete
var claiming = await GetOrganizationIdsClaimingUserAsync(userId);
if (claiming.Any()) return; // cannot self-delete

Type guard

static bool CanSelfDelete(IReadOnlyList<Guid> claimingOrgs) => claimingOrgs is null || claimingOrgs.Count == 0;

Try / catch

try { await client.DeleteAsync("accounts"); }
catch (BadRequestException ex) when (ex.Message.Contains("claimed"))
{ PromptContactAdmin(); }

Prevention

Surface the 'contact your admin' message instead of retrying.
Use admin offboarding for org-owned accounts.
Pre-check claim status via GetOrganizationIdsClaimingUser.

When it happens

Trigger: An organization-managed user (e.g. claimed via directory or enterprise ownership) attempts to delete their own account through DELETE /accounts.

Common situations: Enterprise/Teams member whose account is organization-owned; user provisioned by SCIM/directory and marked as claimed; user left an org but the claim record persists; org enabled account-claiming via policies.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/091ecb7ee06f12e0. Report an issue: GitHub.

Appendix: source

Thrown at src/Api/Auth/Controllers/AccountsController.cs:589

    public async Task Delete([FromBody] SecretVerificationRequestModel model)
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new UnauthorizedAccessException();
        }

        if (!await _userService.VerifySecretAsync(user, model.Secret))
        {
            ModelState.AddModelError(string.Empty, "User verification failed.");
            await Task.Delay(2000);
        }
        else
        {
            // Check if the user is claimed by any organization.
            if (await _userService.IsClaimedByAnyOrganizationAsync(user.Id))
            {
                throw new BadRequestException(new CannotDeleteClaimedAccountError().Message);
            }

            var result = await _userService.DeleteAsync(user);
            if (result.Succeeded)
            {
                return;
            }

            foreach (var error in result.Errors)
            {
                ModelState.AddModelError(string.Empty, error.Description);
            }
        }

        throw new BadRequestException(ModelState);
    }

    [HttpPost("delete")]

View on GitHub (pinned to e93b962371)