Bitwarden

Manage your Bitwarden organization with AI agents. Invite, update, and remove members, organize collections and groups, review enterprise policies, and pull the event log for audit trails through the Bitwarden Public API.

11 actions OAuth available

Bitwarden website ↗ Platform Documentation ↗ Capability data verified 2026-07-28

The HR system marks an employee departure with a final day

List Members matches the departing employee's email to a member ID and reads their role, two-factor status, and collection assignments

List Events pulls the member's recent vault activity so the security lead sees what was touched last

The security lead confirms the identity match and approves the removal, because the wrong member ID locks an active employee out of shared credentials mid-shift

Remove Member revokes access to every organization collection immediately

List Groups verifies the member's former team still resolves collection access through its group assignments

List Events retrieves the removal entry and the agent appends it to the compliance log

The security channel gets the removal record with timestamp and acting account

What This Integration Enables

Credential access is the sharpest edge of identity governance, and it is usually managed with the bluntest tools. Bitwarden's Public API is deliberately scoped: it administers the organization's people and access structure, members, roles, collections, groups, policies, and the event log, and never reads or writes vault secrets. That scoping is exactly right for agent work. FlowRunner agents can run the directory around the vault without ever holding a password. - Joiner-mover-leaver: invite members on hire, adjust roles and collection assignments on team change, remove on departure - Continuous audit: sweep membership for missing two-factor enrollment, over-broad roles, and stale accounts - Group hygiene: provision groups so access is granted in bulk and revoked in bulk, with external IDs for directory sync - Compliance evidence: stream the event log into spreadsheets and alert channels on a schedule, filtered by date, actor, or item The operation that ends someone's access is the one that waits for a person. Everything that reads, reports, and reconciles runs unattended, with [human-in-the-loop](/concepts/human-in-the-loop) gates reserved for the writes that cannot be walked back.

Without FlowRunner

Offboarding has a forgotten door Email and SSO get revoked on day one; the password manager membership lingers for weeks

Access audits are quarterly heroics Someone exports the member list, cross-checks roles and 2FA by hand, and files it until next quarter

The audit log is write-only Events accumulate in Bitwarden and nobody reads them until an incident makes them interesting

With FlowRunner

The last door closes with the first Departures flow from HR to an approved removal in the same day, logged end to end

Audits run themselves weekly Agents sweep members, roles, 2FA enrollment, and collection assignments and surface only the exceptions

The log reaches the people who act Event entries stream to sheets and alert channels while the context is still warm

Use Case Scenarios

Offboarding that reaches the vault the same day

When [Okta](/integrations/okta) deactivates a departing user, the agent finds the matching Bitwarden member with List Members, assembles the evidence, role, collections, last activity from List Events, and posts the removal request to the security lead. On approval, Remove Member revokes organization access immediately, and the agent writes the confirmation entry into the offboarding checklist. The same flow inverts for onboarding: after [Google Workspace Admin](/integrations/google-workspace-admin) creates the account, Invite Member sends the Bitwarden invitation with the right role and collections, so the new hire's first day includes the vault instead of waiting on a ticket.

The access review that stops being a quarter-end project

Every Monday the agent runs List Members and checks each member against policy: two-factor enrolled, role appropriate to team, collection assignments matching the group model from List Groups and List Collections. Members without 2FA post to the security channel in [Slack](/integrations/slack) by name. Owner and Admin role counts get compared against the approved list, and any drift is flagged with the List Events entries showing who changed what. The quarterly access review becomes a sign-off on twelve weekly reports instead of an archaeology dig.

An audit trail that lands where auditors look

On a nightly schedule, the agent pulls new entries from List Events with the continuation token from the previous run and appends them to the compliance workbook in [Google Sheets](/integrations/google-sheets): member changes, group changes, collection and policy actions, each with actor and timestamp. Policy state from List Policies snapshots weekly, so the workbook shows not just what happened but what rules were in force when it did. When the SOC 2 evidence request arrives, the answer is a filter, not a project.

Human-in-Loop Highlight

Remove Member cannot be undone, and its effect is instant: the member loses access to every organization collection the moment the call lands. Fired at the right person on their last day, that is clean offboarding. Fired at the wrong member ID, it locks a working employee out of the shared credentials their whole team runs on, in the middle of whatever they were doing. The member ID is not the user ID, and an email match is a hypothesis, not an identity. So FlowRunner agents never remove on their own match. The agent presents the case: member record, role, collection assignments, recent event activity, HR record it matched against. A person confirms this is the same human being, and only then does the removal run. Update Member gets the same respect, because it replaces the full collection assignment set rather than merging, and a partial list silently strips access the agent never mentioned.

Agent processes routinely

Detects exception requiring judgment

Clear match Continues automatically

Ambiguous Routes to human via email

Human decides

Agent resumes with decision

Agent Capabilities

11 actions

Members

List Members Lists every organization member with ID, email, role, status, two-factor enrollment, and collection assignments. The starting point for audits and the source of the member IDs every other member action needs.
Get Member Retrieves one member by member ID, including role, status, external ID, and collections.
Invite Member Invites a new member by email with a chosen role and optional collection assignments. Bitwarden sends the invitation; the user accepts before confirmation.
Update Member Updates a member's role, external ID, and collection assignments. Replaces the full assignment set, so always pass the complete desired list.
Remove Member Permanently removes a member from the organization with immediate loss of collection access. Cannot be undone, which is why it sits behind this page's human gate.

Collections

List Collections Lists collections with IDs, external IDs, and assigned groups. The access map for grants and audits.
Get Collection Retrieves one collection's group assignments and access flags: read-only, hide-passwords, manage. The Public API exposes access configuration, not the items inside.

Groups

List Groups Lists groups with name, access-all flag, external ID, and assigned collections. Groups are how access scales past per-member grants.
Create Group Creates a group with collection assignments or access-all, plus an external ID for directory sync.

Policies

List Policies Lists enterprise policies with type, enabled state, and configuration: master-password rules, two-step login enforcement, password generator requirements. Enterprise plan required.

Events

List Events Retrieves the organization audit trail of member, group, collection, policy, and vault-item actions, filterable by date range, acting user, or item, paged by continuation token. The raw material for compliance evidence.

Frequently Asked Questions

What can FlowRunner do with Bitwarden?

FlowRunner agents can run List Members, Get Member, and Invite Member in Bitwarden, plus 8 more actions.

Does connecting Bitwarden to FlowRunner require OAuth?

Yes. Bitwarden connects to FlowRunner with OAuth 2.0, so agents authenticate without handling raw credentials.

Can Bitwarden trigger a FlowRunner workflow automatically?

Bitwarden doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.

Start building with Bitwarden

$100 in credits. No card required. Connect in minutes.

Start Building Free Talk to us