Password Manager · Beta

Bitwarden
API integration

Ship Password Manager features without building the integration. Full Bitwarden API access via Proxy, normalized data through Unified APIs, and 20+ MCP-ready tools for AI agents — all extensible to your exact use case.

Built for specific customer use cases. Issues are resolved quickly.

Talk to us

Use Cases

Why integrate with Bitwarden

Common scenarios for SaaS companies building Bitwarden integrations for their customers.

Automate employee onboarding and offboarding in Bitwarden

IT management and HR platforms can sync user lifecycle events to Bitwarden, automatically inviting new hires into the right groups and revoking vault access the moment someone is terminated — eliminating manual credential hygiene.

Continuously audit password management posture for compliance

Compliance automation platforms can pull Bitwarden member and group data to verify that all employees are provisioned into the correct organizational groups, supporting SOC2 and HIPAA evidence collection without manual screenshots.

Sync directory groups to Bitwarden for role-based access control

SaaS products that manage identity or access policies can push group membership changes into Bitwarden, ensuring that shared credential collections automatically reflect organizational role changes across departments.

Provision and deprovision contractor access to shared credentials

Workforce management platforms can programmatically add temporary contractors to specific Bitwarden groups and remove them when engagements end, preventing lingering access to sensitive client passwords.

What You Can Build

Ship these features with Truto + Bitwarden

Concrete product features your team can ship faster by leveraging Truto’s Bitwarden integration instead of building from scratch.

One-click Bitwarden seat provisioning

Automatically invite new employees into Bitwarden and assign them to department-specific groups when they're created in your platform.

Real-time offboarding credential revocation

Instantly remove terminated users from Bitwarden when their status changes to inactive in your HR or IT system, closing the access gap.

Group membership sync dashboard

Display a unified view of Bitwarden groups alongside groups from other directory providers, letting admins spot drift and enforce consistency.

Bulk user-to-group mapping import

Allow admins to upload or define role-to-group mappings that automatically categorize Bitwarden users into the correct collections based on job function.

Compliance evidence export for user directory state

Generate point-in-time snapshots of Bitwarden members and their group assignments to feed directly into audit evidence packages.

SuperAI

Bitwarden AI agent tools

Comprehensive AI agent toolset with fine-grained control. Integrates with MCP clients like Cursor and Claude, or frameworks like LangChain.

list_all_bitwarden_members

List all members of a Bitwarden organization. Returns each member's id.

get_single_bitwarden_member_by_id

Retrieve a single member of a Bitwarden organization by id. Returns the member's id. Required: id.

create_a_bitwarden_member

Create a member in Bitwarden by inviting a user to the organization. Returns the created member object including its id (the unique member identifier returned upon creation). Required:, and a MemberCreateRequestModel request body.

update_a_bitwarden_member_by_id

Update a Bitwarden organization member by id. Returns the updated member object: id plus the member's field set (attributes). Any property omitted from the body is reset, so resend existing values for properties you want to keep. Required: id.

delete_a_bitwarden_member_by_id

Delete a Bitwarden organization member by id. Permanently removes the member from the organization; this cannot be undone, though the user's account itself remains. Returns an empty 204 response on success. Required: id.

list_all_bitwarden_groups

List all groups in a Bitwarden organization. Returns group records unwrapped from the data envelope, each keyed by its string id; remaining group fields are defined upstream.

get_single_bitwarden_group_by_id

Retrieve a single group from a Bitwarden organization by id. Returns the group record keyed by its string id; remaining group fields are defined upstream. Required: id.

create_a_bitwarden_group

Create a new group in a Bitwarden organization. Returns the created group record: id and attributes. Required: and a JSON body following Bitwarden's GroupCreateUpdateRequestModel.

update_a_bitwarden_group_by_id

Update a group in a Bitwarden organization by id. Returns the updated group record: id and attributes. Properties omitted from the body are reset, so send the full desired object. Required: id, and a JSON body following Bitwarden's GroupCreateUpdateRequestModel.

delete_a_bitwarden_group_by_id

Permanently delete a group from a Bitwarden organization by id. This cannot be undone. Returns an empty response on success. Required: id and.

list_all_bitwarden_public_collections

List all collections in your Bitwarden organization. Returns collection objects including id, object, and name; listed collections do not include their associated groups. Required:.

get_single_bitwarden_public_collection_by_id

Get a single Bitwarden collection by its unique id. Returns the collection object including id, object, and name. Required: id.

update_a_bitwarden_public_collection_by_id

Update a Bitwarden collection by id; any request-body property omitted is reset to its existing value. Returns the updated collection object including id, object, and name. Required: id.

delete_a_bitwarden_public_collection_by_id

Permanently delete a Bitwarden collection by id. This cannot be undone. Returns an empty 200 response on success. Required: id.

list_all_bitwarden_public_events

List Bitwarden organization event logs, filtered by date range or actor, paged by a continuation token. Returns: object, type, itemId, collectionId, groupId, policyId, memberId, actingUserId, date, device, ipAddress. Required:. Defaults to the last 30 days when no filters are provided.

bitwarden_group_member_ids_bulk_update

Update a Bitwarden group's member associations by replacing them with the supplied list of member ids. Returns an empty response body on success. Required: group_id, member_ids.

list_all_bitwarden_group_member_ids

List the ids of all members associated with a Bitwarden group. Returns an array of unique member id strings (UUIDs). Required: group_id.

bitwarden_member_group_ids_bulk_update

Update a Bitwarden member's group associations to the supplied list of group ids, replacing the member's existing group memberships. Returns an empty 200 response on success. Required:, member_id, group_ids.

list_all_bitwarden_member_group_ids

Retrieve the group ids for a Bitwarden member. Returns the unique group id UUIDs for every group the member belongs to. Required:, member_id, id.

create_a_bitwarden_member_reinvite

Re-invite a member in Bitwarden by re-sending the invitation email to an organization member. Returns an empty 200 response on success. Required: member_id (the UUID identifier of the member to re-invite).

create_a_bitwarden_organization_import

Import members and groups into a Bitwarden organization from an external system. Returns the imported member record including its id. Required: plus the import request body (OrganizationImportRequestModel) describing the members and groups to import.

list_all_bitwarden_public_policies

List all Bitwarden enterprise policies for your organization. Returns each policy's id, type, and enabled state. Required:.

update_a_bitwarden_public_policy_by_id

Update a Bitwarden enterprise policy by id, toggling it via the enabled body property. Returns the updated policy's id, type, and enabled state. Required: id = the policy type number (0 TwoFactorAuthentication, 1 MasterPassword, 2 PasswordGenerator, 3 SingleOrg, 4 RequireSso, 5 OrganizationDataOwnership, 6 DisableSend, 7 SendOptions, 8 ResetPassword, 9 MaximumVaultTimeout, 10 DisablePersonalVaultExport, 11 ActivateAutofill, ...).

get_single_bitwarden_public_policy_by_id

Retrieve a Bitwarden organization policy's details by policy type. Returns the policy response for the requested type; fields vary by policy type. Required: id = the policy type number (0 TwoFactorAuthentication, 1 MasterPassword, 2 PasswordGenerator, 3 SingleOrg, 4 RequireSso, 5 OrganizationDataOwnership, 6 DisableSend, 7 SendOptions, 8 ResetPassword, 9 MaximumVaultTimeout, 10 DisablePersonalVaultExport, 11 ActivateAutofill, ...).

create_a_bitwarden_member_revoke

Revoke a member's access to the Bitwarden organization. Returns an empty 200 response on success. Required: member_id.

create_a_bitwarden_member_restore

Restore a member's access to the Bitwarden organization. Returns an empty 200 response on success. Required: member_id.

list_all_bitwarden_organization_subscriptions

Get the Bitwarden organization subscription details. Returns: passwordManager (seats, maxAutoScaleSeats, storage), secretsManager (seats, maxAutoScaleSeats, serviceAccounts, maxAutoScaleServiceAccounts).

bitwarden_organization_subscriptions_bulk_update

Update the Bitwarden organization subscription: Password Manager seats/storage and Secrets Manager seats/service accounts. Returns an empty 200 response on success.

Why Truto

Why use Truto’s MCP server for Bitwarden

Other MCP servers give you a static tool list for one app. Truto gives you a managed, multi-tenant MCP infrastructure across 950+ integrations.

Auto-generated, always up to date

Tools are dynamically generated from curated documentation — not hand-coded. As integrations evolve, tools stay current without manual maintenance.

Fine-grained access control

Scope each MCP server to read-only, write-only, specific methods, or tagged tool groups. Expose only what your AI agent needs — nothing more.

Multi-tenant by design

Each MCP server is scoped to a single connected account with its own credentials. The URL itself is the auth token — no shared secrets, no credential leaking across tenants.

Works with every MCP client

Standard JSON-RPC 2.0 protocol. Paste the URL into Claude, ChatGPT, Cursor, or any MCP-compatible agent framework — tools are discovered automatically.

Built-in auth, rate limits, and error handling

Tool calls execute through Truto’s proxy layer with automatic OAuth refresh, rate-limit handling, and normalized error responses. No raw API plumbing in your agent.

Expiring and auditable servers

Create time-limited MCP servers for contractors or automated workflows. Optional dual-auth requires both the URL and a Truto API token for high-security environments.

Unified APIs

Unified APIs for Bitwarden

Skip writing code for every integration. Use Truto’s category-specific Unified APIs out of the box or customize the mappings with AI.

Unified User Directory API

Groups

Groups are a collection of users in the source application. In some applications, they might also be called Teams.

View Docs

Users

The User object represents a User.

View Docs

How It Works

From zero to integrated

Start with Bitwarden in a free sandbox, usually ready within one business day. No boilerplate, no maintenance burden.

Link your customer’s Bitwarden account

Use Truto’s frontend SDK to connect your customer’s Bitwarden account. We handle all OAuth and API key flows — you don’t need to create the OAuth app.

We handle authentication

Don’t spend time refreshing access tokens or figuring out secure storage. We handle it and inject credentials into every API request.

Call our API, we call Bitwarden

Truto’s Proxy API is a 1-to-1 mapping of the Bitwarden API. You call us, we call Bitwarden, and pass the response back in the same cycle.

Unified response format

Every response follows a single format across all integrations. We translate Bitwarden’s pagination into unified cursor-based pagination. Data is always in the result attribute.

FAQs

Common questions about Bitwarden on Truto

Authentication, rate limits, data freshness, and everything else you need to know before you integrate.

How does authentication work with the Bitwarden integration?

Bitwarden's Public API uses OAuth2 client credentials. Your end users provide their organization's client_id and client_secret, which Truto manages securely to handle token issuance and refresh automatically.

What Bitwarden data can I access through Truto's Unified User Directory API?

Truto maps Bitwarden's Members and Groups endpoints to the Unified User Directory API's Users and Groups resources. This covers listing users, checking their status, managing group memberships, and inviting or removing members.

Are there rate limits on the Bitwarden Public API?

Bitwarden applies rate limiting to its Public API. Truto handles retry logic and backoff strategies so your integration doesn't need to manage rate limit errors directly.

Can I write data back to Bitwarden or is it read-only?

Bitwarden's Public API supports both read and write operations for members and groups — including creating invites, updating group assignments, and deleting members. The specific write operations available through Truto depend on the integration build.

Does this integration access vault items or passwords?

No. Bitwarden's Public API is scoped to organizational administration — members, groups, policies, and event logs. Vault contents are end-to-end encrypted and are not exposed through the Public API, so no plaintext passwords are ever accessible.

The tools for Bitwarden aren't listed yet — can I still use this integration?

Bitwarden integrations are built on request. Once you signal interest, Truto builds and ships the integration with full support for auth, pagination, and error handling against Bitwarden's Public API, mapped to the Unified User Directory API.

From the Blog

Bitwarden integration guides

Deep dives, architecture guides, and practical tutorials for building Bitwarden integrations.

Bitwarden

Get Bitwarden integrated into your app

Our team understands what it takes to make a Bitwarden integration successful. A short, crisp 30 minute call with folks who understand the problem.