bitwarden/server · error · BadRequestException

You do not have permission to remove this connection of type

Error message

You do not have permission to remove this connection of type {connection.Type}.

What it means

Thrown by DeleteConnection (DELETE /organizations/connections/{id}) when HasPermissionAsync returns false for the fetched connection's OrganizationId and Type. Permission is type-dependent: Scim requires ManageScim, others require OrganizationOwner. The check uses the persisted connection's type, not anything from the request. Maps to HTTP 400.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs:156

                return new OrganizationConnectionResponseModel(connection, typeof(ScimConfig));
            default:
                throw new BadRequestException($"Unknown Organization connection Type: {type}");
        }
    }

    [HttpDelete("{organizationConnectionId}")]
    public async Task DeleteConnection(Guid organizationConnectionId)
    {
        var connection = await _organizationConnectionRepository.GetByIdAsync(organizationConnectionId);

        if (connection == null)
        {
            throw new NotFoundException();
        }

        if (!await HasPermissionAsync(connection.OrganizationId, connection.Type))
        {
            throw new BadRequestException($"You do not have permission to remove this connection of type {connection.Type}.");
        }

        await _deleteOrganizationConnectionCommand.DeleteAsync(connection);
    }

    private async Task<ICollection<OrganizationConnection>> GetConnectionsAsync(Guid organizationId, OrganizationConnectionType type) =>
        await _organizationConnectionRepository.GetByOrganizationIdTypeAsync(organizationId, type);

    private async Task<bool> HasConnectionTypeAsync(OrganizationConnectionRequestModel model, Guid? connectionId,
        OrganizationConnectionType type)
    {
        var existingConnections = await GetConnectionsAsync(model.OrganizationId, type);

        return existingConnections.Any(c => c.Type == model.Type && (!connectionId.HasValue || c.Id != connectionId.Value));
    }

    /// <summary>
    /// Returns whether the current user has permission to manage a connection of the given <paramref name="type"/>

View on GitHub (pinned to e93b962371)

Solutions

1. Call as a user holding the permission for the connection's type (Owner for CloudBillingSync, ManageScim for Scim).
2. Re-authenticate after a role change so the token reflects current claims.
3. Use an API key / service account explicitly granted delete permission.
4. Confirm the connection belongs to an organization the caller can administer.

// Confirm delete permission based on the stored connection's type
var conn = await client.GetAsync<OrganizationConnectionResponseModel>($"organizations/connections/{id}");
var needsOwner = conn.Type != OrganizationConnectionType.Scim;
var ok = needsOwner
    ? await currentUser.IsOrganizationOwnerAsync(conn.OrganizationId)
    : await currentUser.CanManageScimAsync(conn.OrganizationId);
if (!ok) throw new UnauthorizedAccessException();

When it happens

Trigger: DELETE by a user who lacks the claim for the connection's type: a non-owner deleting CloudBillingSync; a user without ManageScim deleting Scim; calling from a different org context.

Common situations: A custom-scope API token without delete rights; a demoted admin whose cached token still references the connection; a multi-org UI deleting across the wrong tenant.

Related errors

• You do not have permission to create a connection of type {m
• You do not have permission to update this connection.
• You do not have permission to retrieve a connection of type
• Invalid permissions.
• Not authorized.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/de9286213aefe3cf. Report an issue: GitHub.