--- title: "Bitwarden Integration" description: "Manage your Bitwarden organization with AI agents. Invite, update, and remove members, organize collections and groups, review enterprise policies, and pull the event log for audit trails through the Bitwarden Public API." url: https://flowrunner.ai/integrations/bitwarden date_modified: 2026-08-01T02:40:32-07:00 --- # Bitwarden [Identity & Security](https://flowrunner.ai/integrations/category/identity-security) Manage your Bitwarden organization with AI agents. Invite, update, and remove members, organize collections and groups, review enterprise policies, and pull the event log for audit trails through the Bitwarden Public API. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 11 actions · OAuth · available [Bitwarden website](https://bitwarden.com/) · [Platform Documentation](https://bitwarden.com/help/public-api/) · Capability data verified 2026-07-28 1. The HR system marks an employee departure with a final day 2. List Members matches the departing employee's email to a member ID and reads their role, two-factor status, and collection assignments 3. List Events pulls the member's recent vault activity so the security lead sees what was touched last 4. The security lead confirms the identity match and approves the removal, because the wrong member ID locks an active employee out of shared credentials mid-shift 5. Remove Member revokes access to every organization collection immediately 6. List Groups verifies the member's former team still resolves collection access through its group assignments 7. List Events retrieves the removal entry and the agent appends it to the compliance log 8. The security channel gets the removal record with timestamp and acting account ## What This Integration Enables Credential access is the sharpest edge of identity governance, and it is usually managed with the bluntest tools. Bitwarden's Public API is deliberately scoped: it administers the organization's people and access structure, members, roles, collections, groups, policies, and the event log, and never reads or writes vault secrets. That scoping is exactly right for agent work. FlowRunner agents can run the directory around the vault without ever holding a password. - Joiner-mover-leaver: invite members on hire, adjust roles and collection assignments on team change, remove on departure - Continuous audit: sweep membership for missing two-factor enrollment, over-broad roles, and stale accounts - Group hygiene: provision groups so access is granted in bulk and revoked in bulk, with external IDs for directory sync - Compliance evidence: stream the event log into spreadsheets and alert channels on a schedule, filtered by date, actor, or item The operation that ends someone's access is the one that waits for a person. Everything that reads, reports, and reconciles runs unattended, with [human-in-the-loop](https://flowrunner.ai/concepts/human-in-the-loop) gates reserved for the writes that cannot be walked back. ### Without FlowRunner **Offboarding has a forgotten door**: Email and SSO get revoked on day one; the password manager membership lingers for weeks **Access audits are quarterly heroics**: Someone exports the member list, cross-checks roles and 2FA by hand, and files it until next quarter **The audit log is write-only**: Events accumulate in Bitwarden and nobody reads them until an incident makes them interesting ### With FlowRunner **The last door closes with the first**: Departures flow from HR to an approved removal in the same day, logged end to end **Audits run themselves weekly**: Agents sweep members, roles, 2FA enrollment, and collection assignments and surface only the exceptions **The log reaches the people who act**: Event entries stream to sheets and alert channels while the context is still warm ## Use Case Scenarios ### Offboarding that reaches the vault the same day When [Okta](https://flowrunner.ai/integrations/okta) deactivates a departing user, the agent finds the matching Bitwarden member with List Members, assembles the evidence, role, collections, last activity from List Events, and posts the removal request to the security lead. On approval, Remove Member revokes organization access immediately, and the agent writes the confirmation entry into the offboarding checklist. The same flow inverts for onboarding: after [Google Workspace Admin](https://flowrunner.ai/integrations/google-workspace-admin) creates the account, Invite Member sends the Bitwarden invitation with the right role and collections, so the new hire's first day includes the vault instead of waiting on a ticket. ### The access review that stops being a quarter-end project Every Monday the agent runs List Members and checks each member against policy: two-factor enrolled, role appropriate to team, collection assignments matching the group model from List Groups and List Collections. Members without 2FA post to the security channel in [Slack](https://flowrunner.ai/integrations/slack) by name. Owner and Admin role counts get compared against the approved list, and any drift is flagged with the List Events entries showing who changed what. The quarterly access review becomes a sign-off on twelve weekly reports instead of an archaeology dig. ### An audit trail that lands where auditors look On a nightly schedule, the agent pulls new entries from List Events with the continuation token from the previous run and appends them to the compliance workbook in [Google Sheets](https://flowrunner.ai/integrations/google-sheets): member changes, group changes, collection and policy actions, each with actor and timestamp. Policy state from List Policies snapshots weekly, so the workbook shows not just what happened but what rules were in force when it did. When the SOC 2 evidence request arrives, the answer is a filter, not a project. ## Human-in-Loop Highlight Remove Member cannot be undone, and its effect is instant: the member loses access to every organization collection the moment the call lands. Fired at the right person on their last day, that is clean offboarding. Fired at the wrong member ID, it locks a working employee out of the shared credentials their whole team runs on, in the middle of whatever they were doing. The member ID is not the user ID, and an email match is a hypothesis, not an identity. So FlowRunner agents never remove on their own match. The agent presents the case: member record, role, collection assignments, recent event activity, HR record it matched against. A person confirms this is the same human being, and only then does the removal run. Update Member gets the same respect, because it replaces the full collection assignment set rather than merging, and a partial list silently strips access the agent never mentioned. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via email Human decides Agent resumes with decision ## Agent Capabilities 11 actions ### Members 5 - **List Members** Lists every organization member with ID, email, role, status, two-factor enrollment, and collection assignments. The starting point for audits and the source of the member IDs every other member action needs. - **Get Member** Retrieves one member by member ID, including role, status, external ID, and collections. - **Invite Member** Invites a new member by email with a chosen role and optional collection assignments. Bitwarden sends the invitation; the user accepts before confirmation. - **Update Member** Updates a member's role, external ID, and collection assignments. Replaces the full assignment set, so always pass the complete desired list. - **Remove Member** Permanently removes a member from the organization with immediate loss of collection access. Cannot be undone, which is why it sits behind this page's human gate. ### Collections 2 - **List Collections** Lists collections with IDs, external IDs, and assigned groups. The access map for grants and audits. - **Get Collection** Retrieves one collection's group assignments and access flags: read-only, hide-passwords, manage. The Public API exposes access configuration, not the items inside. ### Groups 2 - **List Groups** Lists groups with name, access-all flag, external ID, and assigned collections. Groups are how access scales past per-member grants. - **Create Group** Creates a group with collection assignments or access-all, plus an external ID for directory sync. ### Policies 1 - **List Policies** Lists enterprise policies with type, enabled state, and configuration: master-password rules, two-step login enforcement, password generator requirements. Enterprise plan required. ### Events 1 - **List Events** Retrieves the organization audit trail of member, group, collection, policy, and vault-item actions, filterable by date range, acting user, or item, paged by continuation token. The raw material for compliance evidence. ## Frequently Asked Questions ### What can FlowRunner do with Bitwarden? FlowRunner agents can run List Members, Get Member, and Invite Member in Bitwarden, plus 8 more actions. ### Does connecting Bitwarden to FlowRunner require OAuth? Yes. Bitwarden connects to FlowRunner with OAuth 2.0, so agents authenticate without handling raw credentials. ### Can Bitwarden trigger a FlowRunner workflow automatically? Bitwarden doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at Bitwarden?** This integration exposes Bitwarden to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/bitwarden. Site index: https://flowrunner.ai/llms.txt