bitwarden/server · error · BadRequestException

You do not have permission to retrieve a connection of type

Error message

You do not have permission to retrieve a connection of type {type}.

What it means

Thrown by GetConnection (GET /organizations/connections/{organizationId}/{type}) when HasPermissionAsync returns false for the given organizationId and type. Read access uses the same permission model as write: Scim requires ManageScim, the default branch requires OrganizationOwner. Maps to HTTP 400.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs:123

        }

        switch (model.Type)
        {
            case OrganizationConnectionType.CloudBillingSync:
                return await CreateOrUpdateOrganizationConnectionAsync<BillingSyncConfig>(organizationConnectionId, model, ValidateBillingSyncConfig);
            case OrganizationConnectionType.Scim:
                return await CreateOrUpdateOrganizationConnectionAsync<ScimConfig>(organizationConnectionId, model);
            default:
                throw new BadRequestException($"Unknown Organization connection Type: {model.Type}");
        }
    }

    [HttpGet("{organizationId}/{type}")]
    public async Task<OrganizationConnectionResponseModel> GetConnection(Guid organizationId, OrganizationConnectionType type)
    {
        if (!await HasPermissionAsync(organizationId, type))
        {
            throw new BadRequestException($"You do not have permission to retrieve a connection of type {type}.");
        }

        var connections = await GetConnectionsAsync(organizationId, type);
        var connection = connections.FirstOrDefault(c => c.Type == type);

        switch (type)
        {
            case OrganizationConnectionType.CloudBillingSync:
                if (!_globalSettings.SelfHosted)
                {
                    throw new BadRequestException($"Cannot get a {type} connection outside of a self-hosted instance.");
                }
                return new OrganizationConnectionResponseModel(connection, typeof(BillingSyncConfig));
            case OrganizationConnectionType.Scim:
                return new OrganizationConnectionResponseModel(connection, typeof(ScimConfig));
            default:
                throw new BadRequestException($"Unknown Organization connection Type: {type}");
        }

View on GitHub (pinned to e93b962371)

Solutions

1. Call as a user who holds the required permission (Owner for CloudBillingSync, ManageScim for Scim).
2. Ensure organizationId in the route is a valid, non-empty Guid.
3. Grant the API key / service account the read-appropriate claim if applicable.
4. Use the ConnectionsEnabled endpoint first to confirm the feature is active before deeper calls.

if (organizationId == Guid.Empty) throw new ArgumentException("organizationId required");
var needsOwner = type != OrganizationConnectionType.Scim;
var ok = needsOwner
    ? await currentUser.IsOrganizationOwnerAsync(organizationId)
    : await currentUser.CanManageScimAsync(organizationId);
if (!ok) throw new UnauthorizedAccessException();

static bool IsKnownConnectionType(OrganizationConnectionType t) =>
    t is OrganizationConnectionType.CloudBillingSync or OrganizationConnectionType.Scim;

When it happens

Trigger: GET /organizations/connections/{orgId}/{type} by a user who is not an Owner (for CloudBillingSync) or lacks ManageScim (for Scim); a route where organizationId is Guid.Empty so the permission check short-circuits to false.

Common situations: A read-only viewer or custom-scope token attempting to retrieve connection details; an org member (not owner) checking billing sync config; misrouted request with an empty org id.

Related errors

• You do not have permission to create a connection of type {m
• You do not have permission to update this connection.
• You do not have permission to remove this connection of type
• Invalid permissions.
• Not authorized.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/9ad4a99143123e73. Report an issue: GitHub.