Public Policies API

Manage organization security policies via the Public API

Overview

The Public Policies API allows programmatic configuration of organization security policies.

Policies are only available on Teams and Enterprise plans.

List Policies

Retrieve all policies for the organization.

GET /public/policies

Response

object · string

Always “list”

data · array · required

Array of policy objects

Policy Object

id · string · required

Policy unique identifier

type · string · required

Policy type (see Policy Types below)

enabled · boolean · required

Whether policy is active

data · object

Policy-specific configuration

---

Get Policy

Retrieve a specific policy by ID.

GET /public/policies/{id}

id · string · required

Policy ID

cURL

curl -X GET "https://api.bitwarden.com/public/policies/{id}" \
  -H "Authorization: Bearer {org_api_token}"

---

Update Policy

Enable or update a policy configuration.

PUT /public/policies/{id}

id · string · required

Policy ID

Request Body

enabled · boolean · required

Enable or disable the policy

data · object

Policy-specific configuration (varies by type)

---

Policy Types

Two-Factor Authentication

Require all members to enable 2FA.

{
  "type": "twoFactorAuthentication",
  "enabled": true,
  "data": null
}

Master Password

Enforce master password requirements.

{
  "type": "masterPassword",
  "enabled": true,
  "data": {
    "minComplexity": 3,
    "minLength": 12,
    "requireUpper": true,
    "requireLower": true,
    "requireNumbers": true,
    "requireSpecial": true
  }
}

Password Generator

Set minimum password generator requirements.

{
  "type": "passwordGenerator",
  "enabled": true,
  "data": {
    "defaultType": "password",
    "minLength": 14,
    "useUpper": true,
    "useLower": true,
    "useNumbers": true,
    "useSpecial": true,
    "minNumbers": 1,
    "minSpecial": 1
  }
}

Single Organization

Prevent members from joining other organizations.

{
  "type": "singleOrg",
  "enabled": true,
  "data": null
}

Require SSO

Require SSO authentication.

{
  "type": "requireSso",
  "enabled": true,
  "data": null
}

Personal Ownership

Require all items to be organization-owned.

{
  "type": "personalOwnership",
  "enabled": true,
  "data": null
}

Disable Send

Disable Bitwarden Send.

{
  "type": "disableSend",
  "enabled": true,
  "data": null
}

Send Options

Control Send feature options.

{
  "type": "sendOptions",
  "enabled": true,
  "data": {
    "disableHideEmail": true
  }
}

Reset Password

Allow admin password reset.

{
  "type": "resetPassword",
  "enabled": true,
  "data": {
    "autoEnrollEnabled": false
  }
}

Maximum Vault Timeout

Enforce maximum vault timeout.

{
  "type": "maximumVaultTimeout",
  "enabled": true,
  "data": {
    "minutes": 60
  }
}

---

Examples

Enable Two-Factor Requirement

cURL

curl -X PUT "https://api.bitwarden.com/public/policies/{policyId}" \
  -H "Authorization: Bearer {org_api_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "data": null
  }'

Configure Master Password Policy

const masterPasswordPolicy = policies.data.find(
  p => p.type === 'masterPassword'
);

await fetch(
  `https://api.bitwarden.com/public/policies/${masterPasswordPolicy.id}`,
  {
    method: 'PUT',
    headers: {
      'Authorization': `Bearer ${orgToken}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      enabled: true,
      data: {
        minComplexity: 4,
        minLength: 14,
        requireUpper: true,
        requireLower: true,
        requireNumbers: true,
        requireSpecial: true,
        enforceOnLogin: false
      }
    })
  }
);

Audit Policy Compliance

import requests

# Get all policies
response = requests.get(
    'https://api.bitwarden.com/public/policies',
    headers={'Authorization': f'Bearer {org_token}'}
)

policies = response.json()['data']

# Check which security policies are enabled
security_policies = [
    'twoFactorAuthentication',
    'masterPassword',
    'singleOrg',
    'requireSso'
]

print("Security Policy Status")
print("=====================")

for policy_type in security_policies:
    policy = next(
        (p for p in policies if p['type'] == policy_type),
        None
    )
    
    if policy:
        status = "✓ Enabled" if policy['enabled'] else "✗ Disabled"
        print(f"{policy_type}: {status}")

Automated Policy Setup

// Configure all security policies for new organization
const securityPolicies = {
  twoFactorAuthentication: { enabled: true, data: null },
  singleOrg: { enabled: true, data: null },
  masterPassword: {
    enabled: true,
    data: {
      minComplexity: 3,
      minLength: 12,
      requireUpper: true,
      requireLower: true,
      requireNumbers: true,
      requireSpecial: true
    }
  },
  maximumVaultTimeout: {
    enabled: true,
    data: { minutes: 60 }
  }
};

// Get current policies
const response = await fetch(
  'https://api.bitwarden.com/public/policies',
  {headers: {'Authorization': `Bearer ${orgToken}`}}
);
const policies = await response.json();

// Update each policy
for (const [type, config] of Object.entries(securityPolicies)) {
  const policy = policies.data.find(p => p.type === type);
  
  if (policy) {
    await fetch(
      `https://api.bitwarden.com/public/policies/${policy.id}`,
      {
        method: 'PUT',
        headers: {
          'Authorization': `Bearer ${orgToken}`,
          'Content-Type': 'application/json'
        },
        body: JSON.stringify(config)
      }
    );
    
    console.log(`✓ Configured ${type}`);
  }
}

---

Policy Dependencies

Some policies require others:

Policy	Requires
Reset Password	Single Organization
Require SSO	Single Organization

Enable prerequisite policies first to avoid errors.

---

Best Practices

1. Test in staging - Test policy changes with a subset of users first
2. Communicate changes - Notify users before enabling policies
3. Grace period - Give users time to comply before enforcement
4. Monitor compliance - Check policy adherence regularly
5. Document policies - Keep records of when/why policies were enabled