# Users

Fetches organization member details from Bitwarden, including user roles, status, and access permissions.

**Sync Type: Cron**

## Requirements

Before you connect Monad to Bitwarden, you need to:

1. **Create OAuth2 Credentials**
   - Go to your Bitwarden Organization settings
   - Navigate to the Integrations section
   - Create a new OAuth2 Client for API access
   - You'll receive a Client ID and Client Secret
   - Client ID is in the format: `organization.ClientId`

2. **Determine Your Region**
   - **US**: Uses Bitwarden's US cloud infrastructure (default)
   - **EU**: Uses Bitwarden's EU cloud infrastructure
   - **Self-Hosted**: For on-premises Bitwarden installations, you'll need the base URL of your instance

3. **Required Permissions**
   - Your OAuth2 client must have API permissions to access organization members
   - The credentials must be associated with an organization admin account

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting  | Type   | Required | Description                                                                                   |
| -------- | ------ | -------- | --------------------------------------------------------------------------------------------- |
| Region   | string | No       | Region of the Bitwarden instance: US, EU, or SelfHosted (default: US)                         |
| Base URL | string | No       | Base URL for self-hosted Bitwarden instance (required if region is SelfHosted)                |
| Cron     | string | Yes      | Cron expression defining how often to fetch the full member list (e.g., `0 * * * *` = hourly) |

#### Secrets

| Secret        | Type   | Required | Description                                       |
| ------------- | ------ | -------- | ------------------------------------------------- |
| Client ID     | string | Yes      | OAuth2 Client ID in format: organization.ClientId |
| Client Secret | string | Yes      | OAuth2 Client Secret for API authentication       |

## Limitations

- **Full Snapshot**: This input performs a full snapshot of all organization members on every sync. There is no incremental syncing — all members are returned each run.
- **Regional Isolation**: Separate instances for US and EU regions; self-hosted instances require their own base URL configuration.

## Troubleshooting

### Authentication Errors

- Verify that your Client ID and Client Secret are correct and in the proper format (Client ID must be `organization.ClientId`)
- Ensure the credentials haven't been revoked or expired in your Bitwarden organization settings
- Confirm that your OAuth2 client has the necessary API permissions

### No Members Retrieved

- Confirm your organization has active members
- Ensure the region setting (US/EU/SelfHosted) matches your Bitwarden instance location
- For self-hosted instances, verify the Base URL is correct and accessible

### Connection Timeout

- For self-hosted instances, verify the Base URL is correct and reachable from Monad

## Related Articles

- [Bitwarden Public API Documentation](https://bitwarden.com/help/article/public-api/)
- [Bitwarden Organization Admin Guide](https://bitwarden.com/help/article/managing-users/)
- [Bitwarden Member Types and Roles](https://bitwarden.com/help/user-types-access-control/)

## Sample Record

```json
{
  "type": 0,
  "externalId": "external_id_123456",
  "permissions": {
    "accessEventLogs": true,
    "accessImportExport": true,
    "accessReports": true,
    "createNewCollections": true,
    "editAnyCollection": true,
    "deleteAnyCollection": true,
    "manageGroups": true,
    "managePolicies": true,
    "manageSso": true,
    "manageUsers": true,
    "manageResetPassword": true,
    "manageScim": true
  },
  "object": "member",
  "id": "539a36c5-e0d2-4cf9-979e-51ecf5cf6593",
  "userId": "48b47ee1-493e-4c67-aef7-014996c40eca",
  "name": "John Smith",
  "email": "jsmith@example.com",
  "twoFactorEnabled": true,
  "status": 0,
  "collections": [
    {
      "id": "bfbc8338-e329-4dc0-b0c9-317c2ebf1a09",
      "readOnly": true,
      "hidePasswords": true,
      "manage": true
    }
  ],
  "resetPasswordEnrolled": true,
  "ssoExternalId": "sso_external_id_123456"
}
```

## Sync frequency

This input runs on a cron schedule (default hourly, `0 * * * *`), which you can configure on the pipeline. See [Input Sync Frequency](../../guides/sync-frequency) for details.