bitwarden/server · error · BadRequestException

Your organization's plan does not support this feature.

Error message

Your organization's plan does not support this feature.

What it means

Thrown by AuthorizeAsync when the organization's cached ability is null or UseRiskInsights is false. This means the organization's plan does not include the Risk Insights / Access Intelligence feature, so all report endpoints reject the call as 400. This is a plan/entitlement gate, not an authn/rbac gate (which would be 404 via error 315).

Source

Thrown at src/Api/Dirt/Controllers/OrganizationReportsController.cs:480

        if (stream == null)
        {
            throw new NotFoundException();
        }

        return File(stream, "application/octet-stream", fileData.FileName);
    }

    private async Task AuthorizeAsync(Guid organizationId)
    {
        if (!await _currentContext.AccessReports(organizationId))
        {
            throw new NotFoundException();
        }

        var orgAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(organizationId);
        if (orgAbility is null || !orgAbility.UseRiskInsights)
        {
            throw new BadRequestException("Your organization's plan does not support this feature.");
        }
    }

    private static void EnsureValidIds(Guid organizationId, Guid? reportId = null)
    {
        if (organizationId == Guid.Empty)
        {
            throw new BadRequestException("OrganizationId is required.");
        }

        if (reportId.HasValue && reportId.Value == Guid.Empty)
        {
            throw new BadRequestException("ReportId is required.");
        }
    }

    private async Task<OrganizationReport> GetAuthorizedReportAsync(Guid organizationId, Guid reportId)
    {

View on GitHub (pinned to e93b962371)

Solutions

1. Upgrade the organization to a plan that includes Risk Insights / Access Intelligence.
2. After upgrade, wait for the organization ability cache to refresh (or trigger a cache invalidation) and retry.
3. If orgAbility is consistently null, verify the ability cache service is wired and the org has a populated ability record.

var ability = await GetOrgAbilityAsync(organizationId);
if (ability is null || !ability.UseRiskInsights)
    throw new InvalidOperationException("Organization plan does not include Risk Insights.");

try { await client.GetAsync(reportUrl); }
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest && ex.Message.Contains("plan"))
{ /* prompt user to upgrade; do not retry until plan changes */ }

When it happens

Trigger: The organization is on a plan tier (e.g. Free, Teams without risk-insights add-on) that does not set UseRiskInsights in its abilities, OR the ability cache has not yet been populated (orgAbility is null).

Common situations: Trial/expired Enterprise entitlement; org never purchased the risk-insights SKU; ability cache lag after a plan upgrade (cache hasn't refreshed); self-hosted without the feature licensed.

Related errors

• Request failed. Status code: {0}
• Resource not found.
• Max file size is 500 MB.
• ReportFileId is required.
• Resource not found.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/0b280650d5dad0c1. Report an issue: GitHub.