bitwarden/server · error · BadRequestException

You do not have permission to create a connection of type {m

Error message

You do not have permission to create a connection of type {model.Type}.

What it means

Thrown by OrganizationConnectionsController.CreateConnection (POST /organizations/connections) when HasPermissionAsync returns false. Permission is type-dependent: Scim connections require the ManageScim claim, while all other types (default branch) require OrganizationOwner. The check also returns false when model.OrganizationId is null/empty, so a missing or zero Guid fails here before the type-specific claim is even evaluated. Maps to HTTP 400 via BadRequestException.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs:59

        _deleteOrganizationConnectionCommand = deleteOrganizationConnectionCommand;
        _organizationConnectionRepository = organizationConnectionRepository;
        _currentContext = currentContext;
        _globalSettings = globalSettings;
        _licensingService = licensingService;
    }

    [HttpGet("enabled")]
    public bool ConnectionsEnabled()
    {
        return _globalSettings.SelfHosted && _globalSettings.EnableCloudCommunication;
    }

    [HttpPost]
    public async Task<OrganizationConnectionResponseModel> CreateConnection([FromBody] OrganizationConnectionRequestModel model)
    {
        if (!await HasPermissionAsync(model.OrganizationId, model.Type))
        {
            throw new BadRequestException($"You do not have permission to create a connection of type {model.Type}.");
        }

        if (await HasConnectionTypeAsync(model, null, model.Type))
        {
            throw new BadRequestException($"The requested organization already has a connection of type {model.Type}. Only one of each connection type may exist per organization.");
        }

        switch (model.Type)
        {
            case OrganizationConnectionType.CloudBillingSync:
                return await CreateOrUpdateOrganizationConnectionAsync<BillingSyncConfig>(null, model, ValidateBillingSyncConfig);
            case OrganizationConnectionType.Scim:
                return await CreateOrUpdateOrganizationConnectionAsync<ScimConfig>(null, model);
            default:
                throw new BadRequestException($"Unknown Organization connection Type: {model.Type}");
        }
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Verify the calling user's role: CloudBillingSync requires Organization Owner, Scim requires the ManageScim permission — promote the user or use an account that already holds the claim.
2. Ensure model.OrganizationId is a real, non-empty Guid in the request body (not Guid.Empty and not omitted).
3. Confirm the request carries the correct authentication token for the intended organization user (not a personal account lacking org membership).
4. If using an API key / service account, grant it the necessary organization-scoped permissions before retrying.

Example fix

// before
var model = new OrganizationConnectionRequestModel {
    Type = OrganizationConnectionType.CloudBillingSync,
    OrganizationId = Guid.Empty  // fails permission check
};
// after
var model = new OrganizationConnectionRequestModel {
    Type = OrganizationConnectionType.CloudBillingSync,
    OrganizationId = fetchedOrgId  // real Guid, caller is an Owner of this org
};

// Before POST, ensure the caller holds the right claim and a valid org id
if (model.OrganizationId == Guid.Empty) throw new ArgumentException("OrganizationId required");
var needsOwner = model.Type != OrganizationConnectionType.Scim;
var canManage = needsOwner
    ? await currentUser.IsOrganizationOwnerAsync(model.OrganizationId)
    : await currentUser.CanManageScimAsync(model.OrganizationId);
if (!canManage) throw new UnauthorizedAccessException("Caller lacks permission for this connection type");

static bool CanCreateConnection(OrganizationConnectionType t) =>
    t is OrganizationConnectionType.CloudBillingSync or OrganizationConnectionType.Scim;

When it happens

Trigger: POST /organizations/connections where the authenticated user lacks the claim for the requested type: a non-owner calling with type=CloudBillingSync, a user without ManageScim calling with type=Scim, or any request where model.OrganizationId is Guid.Empty / omitted (the client sent no organizationId in the JSON body).

Common situations: An admin (not owner) trying to set up Cloud Billing Sync; a custom-scoped API token or service account that was never granted ManageScim; a client bug that sends an empty Guid because the org context was never loaded; testing against a freshly provisioned org where the calling user has not yet been promoted to owner.

Related errors

• You do not have permission to update this connection.
• You do not have permission to retrieve a connection of type
• You do not have permission to remove this connection of type
• Invalid permissions.
• Not authorized.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/d799468a993eacb5. Report an issue: GitHub.