Operate the account profile, two-factor methods, emergency access, and audit event feeds.

Dispatches to every Vaultwarden accounts, two_factor, emergency_access, and events API route by its route name.

CONCEPT:VW-ECO.mcp.account-operations

Administer the instance (users, config, diagnostics), plus identity-server and favicon routes.

Admin routes require the instance admin token (VW_ADMIN cookie auth). When it is not configured, or is rejected, the server's error is surfaced as a clear {"error", "status"} dict rather than a raw exception.

CONCEPT:VW-ECO.mcp.admin-operations

Manage organizations, collections, members, groups, and policies, plus the public LDAP import and misc server-settings/HIBP routes.

Dispatches to every Vaultwarden organizations, public, and misc API route by its route name.

CONCEPT:VW-ECO.mcp.organization-operations

Create, list, update, and remove Bitwarden Sends (text or file).

Dispatches to every Vaultwarden sends API route by its route name.

CONCEPT:VW-ECO.mcp.send-operations

List items (vaultwarden_ciphers). Read and write vault items (ciphers).

The decrypted actions (list_items, get_item, create_item, edit_item) return or accept plaintext item contents because the caller explicitly asked for them — never log, echo, or otherwise surface that content elsewhere. move_to_trash soft-deletes items by id (recoverable). Every other ciphers API route is reachable by its route name via call_operation.

CONCEPT:VW-ECO.mcp.cipher-operations

Get item (vaultwarden_ciphers). Read and write vault items (ciphers).

The decrypted actions (list_items, get_item, create_item, edit_item) return or accept plaintext item contents because the caller explicitly asked for them — never log, echo, or otherwise surface that content elsewhere. move_to_trash soft-deletes items by id (recoverable). Every other ciphers API route is reachable by its route name via call_operation.

CONCEPT:VW-ECO.mcp.cipher-operations

Create item (vaultwarden_ciphers). Read and write vault items (ciphers).

The decrypted actions (list_items, get_item, create_item, edit_item) return or accept plaintext item contents because the caller explicitly asked for them — never log, echo, or otherwise surface that content elsewhere. move_to_trash soft-deletes items by id (recoverable). Every other ciphers API route is reachable by its route name via call_operation.

CONCEPT:VW-ECO.mcp.cipher-operations

Edit item (vaultwarden_ciphers). Read and write vault items (ciphers).

The decrypted actions (list_items, get_item, create_item, edit_item) return or accept plaintext item contents because the caller explicitly asked for them — never log, echo, or otherwise surface that content elsewhere. move_to_trash soft-deletes items by id (recoverable). Every other ciphers API route is reachable by its route name via call_operation.

CONCEPT:VW-ECO.mcp.cipher-operations

Move to trash (vaultwarden_ciphers). Read and write vault items (ciphers).

The decrypted actions (list_items, get_item, create_item, edit_item) return or accept plaintext item contents because the caller explicitly asked for them — never log, echo, or otherwise surface that content elsewhere. move_to_trash soft-deletes items by id (recoverable). Every other ciphers API route is reachable by its route name via call_operation.

CONCEPT:VW-ECO.mcp.cipher-operations

List folders (vaultwarden_folders). Read and write personal-vault folders.

list_folders and create_folder (name) return decrypted folder names because the caller explicitly asked for them. Every other folders API route is reachable by its route name via call_operation.

CONCEPT:VW-ECO.mcp.folder-operations

Create folder (vaultwarden_folders). Read and write personal-vault folders.

list_folders and create_folder (name) return decrypted folder names because the caller explicitly asked for them. Every other folders API route is reachable by its route name via call_operation.

CONCEPT:VW-ECO.mcp.folder-operations

Plan deduplication (vaultwarden_maintenance). Plan/apply vault deduplication and rotate or generate passwords.

Deduplication and rotation results carry item ids and counts only. Applying deduplication or rotating a password requires confirm: true, and a loose deduplication plan is never applied automatically.

CONCEPT:VW-ECO.mcp.maintenance-operations

Apply deduplication (vaultwarden_maintenance). Plan/apply vault deduplication and rotate or generate passwords.

Deduplication and rotation results carry item ids and counts only. Applying deduplication or rotating a password requires confirm: true, and a loose deduplication plan is never applied automatically.

CONCEPT:VW-ECO.mcp.maintenance-operations

Rotate password (vaultwarden_maintenance). Plan/apply vault deduplication and rotate or generate passwords.

Deduplication and rotation results carry item ids and counts only. Applying deduplication or rotating a password requires confirm: true, and a loose deduplication plan is never applied automatically.

CONCEPT:VW-ECO.mcp.maintenance-operations

Generate password (vaultwarden_maintenance). Plan/apply vault deduplication and rotate or generate passwords.

Deduplication and rotation results carry item ids and counts only. Applying deduplication or rotating a password requires confirm: true, and a loose deduplication plan is never applied automatically.

CONCEPT:VW-ECO.mcp.maintenance-operations

Metadata snapshot (vaultwarden_metadata). Serve the certified metadata-only source projection.

metadata_snapshot returns opaque identifiers, type codes, lifecycle timestamps, counts, and typed relationships. Scion SDK source_sync is the only graph commit/checkpoint/reconcile authority. Backfeed is explicitly unsupported.

CONCEPT:VW-KG.ingest.metadata-only

Backfeed metadata (vaultwarden_metadata). Serve the certified metadata-only source projection.

metadata_snapshot returns opaque identifiers, type codes, lifecycle timestamps, counts, and typed relationships. Scion SDK source_sync is the only graph commit/checkpoint/reconcile authority. Backfeed is explicitly unsupported.

CONCEPT:VW-KG.ingest.metadata-only

Generate/rotate the personal API key (client_credentials login secret)

Get KDF type/iterations for an email before login (also mounted at /identity/accounts/prelogin)

Rotate the personal API key

Enable TOTP 2FA by confirming a generated code

Enable TOTP 2FA (PUT alias)

Enable/update Duo (or Duo OIDC) 2FA

Enable/update Duo 2FA (PUT alias)

Register a new WebAuthn security key for 2FA

Register a WebAuthn key (PUT alias)

Enable YubiKey OTP 2FA

Enable YubiKey OTP 2FA (PUT alias)

Permanently delete an organization and all its data

Liveness/health check (also verifies DB connectivity)

Grantor approves an in-progress request early (skips wait)

Archive one cipher (hide from default view, distinct from trash)

Bulk archive ciphers

Trigger an on-demand database backup (sqlite only)

Bulk confirm accepted invites, delivering the org key to each new member

Bulk delete groups

Bulk remove members from the org

Bulk delete collections by id

Bulk-fetch public keys for a list of user ids

Bulk resend pending invites

Bulk restore revoked members

Bulk revoke members

Return server config/feature-flags/environment URLs used by clients on startup

Grantor confirms the grantee, delivering the grantor’s vault key encrypted for the grantee

Confirm one accepted invite

Create a new organization

Force-logout a user (invalidate all sessions/security stamp)

Delete own account (REST DELETE alias)

Delete an attachment

Delete an attachment (admin path)

Delete an attachment (POST alias)

Delete an attachment (admin path, POST alias)

Permanently delete a cipher (REST DELETE)

Permanently delete via admin path (REST DELETE)

Permanently delete a cipher (POST alias)

Permanently delete a cipher via admin path

Soft-delete (move to trash) a cipher

Soft-delete via admin path

Bulk permanently delete ciphers by id list

Bulk permanent delete via admin path

Bulk permanent delete (POST alias)

Bulk permanent delete via admin path (POST alias)

Bulk soft-delete (move to trash)

Bulk soft-delete via admin path

Reset configuration overrides back to defaults

Delete/revoke an emergency-access relationship

Delete a folder

Delete a folder (POST alias)

Delete a group

Remove one member from the org

Delete a collection

Delete a Send

Unlink a user’s SSO identity (force back to password login)

Permanently delete an instance user account

Remove a registered WebAuthn security key

Disable TOTP 2FA

Disable a specific 2FA provider

Disable a specific 2FA provider (PUT alias)

Disable (lock) a user account instance-wide

Anonymous: download the actual (still-encrypted) Send file bytes

Edit a member (POST alias)

Confirm email-2FA setup with the emailed code

Grantee accepts a pending emergency-access invite

Grantor invites another user (by email) as emergency contact

Re-enable a disabled user account

Generate a new TOTP secret + provisioning QR data

Generate a WebAuthn registration challenge

Get current YubiKey OTP 2FA configuration (masked)

List current user devices

Stub empty passkey list (prevents client errors; Vaultwarden does not support WebAuthn passwordless login)

Get attachment metadata + a short-lived download URL

Poll status of one auth request by id

Anonymous poll for approval + encrypted key once approved

List all pending/approved auth requests for current user

List only pending auth requests

Check whether org auto-enrolls new members into password-reset admin recovery

Get org billing metadata

Get org billing warning banners

Get one cipher by id

Get one cipher with admin-view fields (org admin bypassing normal access)

Get one cipher with full details incl. collection ids

List audit-log events for one cipher

List all ciphers owned by or shared with the user

List users/groups with access to one collection

List people the caller has granted emergency access to (as grantor)

Get one device by identifier

Get/return device-verification (new-device email) settings

Get sanitized server config as JSON for diagnostics

Diagnostic HTTP echo/status-code test endpoint

Return an empty master-password-policy stub for a placeholder org id

Get current Duo 2FA configuration (masked)

Check whether email 2FA is set up / request setup email

Get one emergency-access record by id

Get one folder by id

List all folders

List people who have granted the caller emergency access (as grantee)

Get one group

Get one group with members + collections

List members of a group

List org groups (collections of members for access assignment)

List groups with member/collection details

Check whether a device identifier is already known for an email

Get the effective master-password-complexity policy for the org

List organization members ("users")

Get one collection’s details

List all collections in an org

List collections with per-collection access details

Get org-scoped cipher listing with per-cipher collection membership

Check whether an org’s SSO domain claim is verified

List audit-log events for an organization

Export all org cipher data (admin-triggered org vault export)

List members with minimal fields (id/name/email) for UI pickers

Get organization details

Get the org’s public key + (if authorized) encrypted private key

Get the org’s public RSA key

List available subscription plans

Get one policy by type

Get another user public RSA key by user id

Get the 2FA recovery code (used if all 2FA devices are lost)

Get the data needed to perform admin password reset for a member (their reset_password_key + KDF settings)

Get self-host billing metadata

Get one of the caller’s own Sends by id

List the caller’s own Sends

Get the user’s configured equivalent-domains list (for autofill matching)

List pending security tasks (at-risk password / admin-assigned tasks) for the current device

List enabled 2FA methods for the user

Get one member’s full details

Look up one instance user by email

List collections the current user has access to (across all orgs)

List audit-log events for one org member

Get one instance user by id

List all instance users (JSON, for the admin table)

List registered WebAuthn/FIDO2 2FA security keys

Proxy a Have I Been Pwned breach lookup for a username

Fetch/cache a site favicon by hostname from the internet

Serve a favicon from local cache without external fetch (used when icon fetching is disabled)

Get a user’s KDF type/iterations/memory/parallelism by email before attempting login

Register a new account (email, name, master-password hash, encrypted keys, KDF params)

Grantee starts the takeover/view waiting period

Create/invite a new instance user from the admin panel

Bulk-provision/deprovision org members + groups from an external directory (SCIM/LDAP-style)

Current user leaves an organization

List all policies configured for the org

List policies visible to an not-yet-member using their invite token

Bulk move ciphers into a folder (or remove from folder)

Bulk move ciphers into a folder (PUT alias)

Return current server time

Invited user accepts the org invite

Delete an organization

Generate/rotate the org’s API key (for client_credentials / public API access)

Rotate the org’s API key

Invite a user to the organization by email

Grantee completes takeover: uploads the grantor’s user key re-encrypted under a NEW master key/password chosen by the grantee

Request password hint be emailed

Get org policies applicable to the emergency-access relationship

Anonymous: fetch a Send’s metadata by access id (for viewing/decrypting)

Anonymous: get a download URL for a Send file

Anonymous: legacy get-download-URL path

Anonymous: legacy path for fetching a Send by access id

Upload attachment (legacy single-phase)

Upload attachment via admin path

Re-key an attachment when its cipher is shared to an org

Begin attachment upload (v2): register metadata, get upload URL

Upload the encrypted attachment bytes (v2 second phase)

Create a new device "login with device" auth request

Bulk-set which users/groups can access a set of collections

Bulk-assign a set of ciphers to collections

Update a cipher

Update a cipher via the admin path (POST alias)

Partial update: only folder assignment / favorite flag (no re-encryption needed)

Move a personal cipher into an organization ("share")

Create a cipher (personal or org, no collections in this call)

Create a cipher as an org admin on behalf of the org (unassigned/admin path)

Create a cipher, optionally assigning collections in the same call

Bulk import ciphers + folders in one call

Clear a device push token (POST alias)

Set collections (v2, POST alias)

Set collections via admin path (POST alias)

Set collections (legacy v1, POST alias)

Persist configuration overrides (the settings normally set via env vars)

Delete own account (password/OTP confirmation in body)

Delete/revoke (POST alias)

Delete a group (POST alias)

Remove one member from a group

Delete an organization (POST alias)

Request account-deletion email (forgot-password-style deletion init)

Complete account deletion using emailed token

Set/update device push token

Confirm email change with token + new encrypted keys

Request email-change verification token (send code to new address)

Update an emergency-access grant (POST alias)

Client-side telemetry/event ingestion endpoint used by web-vault to batch-report UI events

Rename a folder (POST alias)

Create a folder

Update a group (POST alias, id in path)

Create a group

Change KDF algorithm/parameters (PBKDF2↔Argon2id, iterations, memory, parallelism)

Upload/set the user RSA keypair (encrypted private key + public key)

Bulk import ciphers directly into an organization (personal-vault-style import scoped to an org)

Upload the organization’s RSA keypair at org-creation time

Update organization settings (POST alias)

Delete a collection (POST alias)

Update a collection (POST alias)

Create a collection

Change master password

Update profile fields (legacy POST alias of PUT)

Full account key rotation: re-encrypt user key, private key, and every cipher/folder/send key

Create a text-type (or metadata-only) Send

Create a file-type Send (legacy single-phase upload)

Begin a file-type Send (v2): register metadata, get upload URL

Upload the encrypted Send file bytes (v2 second phase)

Set initial master password (post-SSO/key-connector account provisioning)

Set equivalent-domains list

Rotate security stamp (invalidates all other sessions/JWTs)

Request email verification (resend verify link) for current email

Verify current email address ownership via emailed token

Variant prelogin returning the newer MasterPasswordUnlockData shape

Pre-validate an SSO organization identifier before redirecting to the IdP

Get own user profile (email, name, org memberships, premium status)

Irreversibly delete ALL ciphers in an organization

Irreversibly delete ALL of the caller’s personal ciphers (and folders)

Approve/deny an auth request from an already-approved device

Set avatar color

Update a cipher (PUT alias)

Update a cipher via the admin path

Partial update (PUT alias)

Share a cipher (PUT alias)

Bulk share multiple ciphers to an org

Clear a device push token (public, used by push relay callbacks)

Set the collections a cipher belongs to (v2, returns updated cipher)

Set collections via admin path

Set the collections a cipher belongs to (legacy v1)

Set/update device push token (PUT alias)

Update wait-time/type of an emergency-access grant

Rename a folder

Update a group

Set which members belong to a group

Edit a member (role, collection access, groups)

Update organization settings (name, billing email, etc.)

Update a collection (rename, reassign users/groups)

Update one policy by type

Update one policy by type (newer response shape)

Update profile fields (name, avatar color)

Admin completes account-recovery: submits a brand-new master key for a member using the org-held reset_password_key

Remove the password requirement from a Send

Alias/step of admin-initiated password reset

Member opts in/out of admin password-reset recovery

Update a Send (name/notes/text/expiry/password/max access count)

Set equivalent-domains list (PUT alias)

Finish registration after email verification (submits the same keyset payload as identity_register)

Send the registration email-verification code

Resend one pending invite

Grantor rejects/cancels an in-progress request

Strip all 2FA methods from a user (admin recovery action)

Request an OTP (emailed) to re-verify identity before a sensitive action

Grantor resends a pending emergency-access invite

Resend a pending registration invite email

Restore one cipher from trash

Restore one cipher from trash via admin path

Bulk restore from trash

Bulk restore from trash via admin path

Restore a revoked member

Restore a revoked member (newer response shape)

Get last vault revision timestamp (used by clients to decide whether to sync)

Revoke one member’s access without removing them (keeps external_id/history)

Send/resend the email-2FA setup verification code

Send the 2FA email code during login (pre-auth, device-scoped)

Full vault sync: ciphers, folders, collections, sends, org/policy/domain metadata in one payload

Grantee begins password takeover: server returns grantor’s KDF settings + encrypted key

Send a test email to verify SMTP configuration

Unarchive one cipher

Bulk unarchive ciphers

Change a user’s org role from the admin panel

Force a client-sync revision bump for one/many users

Verify the OTP from request_otp

Verify current master password hash (used before sensitive UI actions)

Return server version string

Grantee views the grantor’s vault (read-only) after approval/wait elapses