How DSALTA integrates with Bitwarden — data collected, setup guide, and automated compliance checks.
Overview
How to connect
Automated checks
Useful links
DSALTA connects to Bitwarden using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules.DSALTA authenticates with a Bitwarden organization API key against the Bitwarden Public API and syncs your organization members for access reviews.
Read-only access. DSALTA never modifies, creates, or deletes resources in your Bitwarden organization — it only reads your members for access reviews.
DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.
DSALTA reads the Bitwarden organization member roster — name, email, role (Owner, Admin, Manager, Custom or User), member status (invited and revoked members show as Inactive; accepted and confirmed members show as Active) and whether the member has two-step login enabled — which appears on your Access page.It calls these Bitwarden endpoints:
/connect/token
/public/members
Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Bitwarden environment.
There is no Reconnect button. Open Integrations → Connected, click Manage on the Bitwarden card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Bitwarden. This usually happens when the organization API key was rotated in Bitwarden. Issue a new secret with Admin Console → Settings → Organization info → Rotate API key, then paste the client_id and the new client_secret again. Rotating changes the client_secret only — the client_id stays organization.<your organization id>.
Data is not syncing
Confirm the client_id and client_secret are current and that the region matches where your organization is hosted (us or eu). Then click Sync from integrations on the Integrations page (Connected tab) — it refreshes every connected integration at once.
Paste your Bitwarden organization client_id and client_secret to sync members.Before you begin
Your Bitwarden organization must be on Teams or Enterprise — Bitwarden states that “Access to the Bitwarden Public API is available for all Enterprise and Teams organizations”. Families and free organizations have no API key section to copy from.
You must be an organization owner. Bitwarden only lets owners retrieve the organization API key from the Admin Console — admins and managers do not see it.
You will need:
Field
Where to find it
Example
Organization client_id
Bitwarden → Admin Console → Settings → Organization info → View API Key → OAuth2 client_id.
organization.xxxxxxxx-…
Organization client_secret
Shown next to the client_id in the same dialog.
client secret
Region (us or eu)
Cloud region: us (default) or eu. Self-hosted: leave blank and contact support to set custom URLs.
us
1
Start in DSALTA
Open Integrations in the DSALTA sidebar, find Bitwarden, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.
2
Integrating Bitwarden with DSALTA means
DSALTA will only be able to read your Bitwarden organization members for access reviews. Read-only — DSALTA never modifies your vault or settings.
3
Get your organization API key
In Bitwarden: Admin Console → Settings → Organization info → View API Key. Copy the client_id and client_secret.In the Admin Console open Settings → Organization info and scroll to the API key section. Treat the pair like a root credential — Bitwarden warns that “Your organization API key enables full access to your organization”. If it ever leaks, use Rotate API key on the same screen; the client_id stays the same but the client_secret changes, so you must reconnect DSALTA with the new secret before the next sync.
4
Enter your credentials
Paste the client_id and client_secret (and region if EU), then click Connect.
Leave Region empty or us for the default cloud; enter eu only if your organization lives on bitwarden.eu. DSALTA uses the value to pick both hosts — identity.bitwarden.com + api.bitwarden.com for us, identity.bitwarden.eu + api.bitwarden.eu for eu — so a European organization connected as us fails as an invalid client rather than as a wrong region.
DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.
If the connection is rejected. Invalid client_id/client_secret or wrong region. Check your organization API key.The on-screen message is generic — see Connection error messages.
Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.
.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)