Overview

Bitwarden Inspector (Beta)

Bitwarden is a password and secrets manager that organizations use to store and share credentials securely. The Bitwarden Inspector (Beta) connects to a Bitwarden organization through the Bitwarden Public API and reports its security policies, members with their role and two-step login (2FA) status, groups, and collections back into Liongard — so you can see who holds Owner and Admin rights, who's missing 2FA, and whether vault security policies stay enforced, without logging into the Admin Console.

What you can monitor

The Bitwarden Inspector collects organization-level security posture, including:

• Require Two-Step Login, Master Password Requirements, Single Organization, and Require Single Sign-On policy enforcement
• Members, with role, account status, and two-step login status
• Owner, Admin, and revoked member counts
• Groups and collections (access-control structure)
• The organization's event log (event type, date, member, IP address, and device), where Bitwarden provides it. Events are stored with each inspection but don't have their own tab

How it works

Each launchpoint connects to one Bitwarden organization using that organization's Public API key. Bitwarden doesn't offer an API to list every organization an MSP manages, so you create one launchpoint per managed organization.

Benefits

• Catch a disabled two-step login, master password, or SSO policy as a change event.
• Get alerted when the number of Owners or Admins changes, and review exactly who holds those roles on the Members tab.
• Identify members without two-step login and close 2FA gaps across your customer base.
• Keep a timeline of vault administration changes to prove value in QBRs and security reviews.

The Inspector ships with 10 alert rules, listed in the Bitwarden Inspector Summary. All rules ship disabled — enable the ones you want.

Inspector Setup Preparation

Retrieve the Organization's API Key

1. Sign in to the Bitwarden web vault and open the Admin Console for the organization you want to monitor.
2. Navigate to Settings > Organization info.
3. Scroll to the API key section and select View API Key. You may be prompted to re-enter your master password.
4. Copy the client_id (it has the form organization.<GUID>) and the client_secret, and store them securely.

Liongard Inspector Setup

In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the Bitwarden Inspector > Select Add System.

Fill in the following information:

• Environment: Select the Environment this System Inspector should be associated to
• Friendly Name: Suggested: "Bitwarden [Environment Name]"
• Agent: Select the On-Demand Agent. For a self-hosted Bitwarden server that isn't reachable from the internet, select a Self-Managed Agent that can reach it. A Self-Managed Agent needs outbound HTTPS (port 443) to identity.bitwarden.com and api.bitwarden.com (US), identity.bitwarden.eu and api.bitwarden.eu (EU), or your self-hosted server
• Inspector Version: Latest
• Client ID: The organization's client_id
• Client Secret: The organization's client_secret
• Region: Select where your organization is hosted: US (vault.bitwarden.com), EU (vault.bitwarden.eu), or Self-Hosted. Defaults to US, so EU organizations must change it
• Self-Hosted Base URL: Required only for Self-Hosted — your server's root URL only (for example, https://bitwarden.example.com), not an /api or /identity path. The Inspector adds those itself, and the connection always uses HTTPS
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule

Select Save. The Inspector will now be triggered to run within the minute.

Repeat these steps for each Bitwarden organization you manage — one launchpoint per organization.

Troubleshooting

• "Bitwarden rejected the organization API key" error: The Client ID is a personal API key (it starts with user. instead of organization.), the Client ID or Client Secret is mistyped, the API key was rotated in the Admin Console, or the Region doesn't match where the organization is hosted. Copy both values again from Settings > Organization info > View API Key and re-enter them, and confirm whether you sign in at vault.bitwarden.com (US) or vault.bitwarden.eu (EU), or enter the correct Self-Hosted Base URL.
• "Could not reach the Bitwarden identity endpoint" error: The agent can't reach Bitwarden. For Self-Hosted, check the Self-Hosted Base URL and confirm the selected agent can reach that server over HTTPS.
• "Region is set to Self-Hosted but Self-Hosted Base URL is not configured" error: Enter the Self-Hosted Base URL, or change the Region.
• Groups or Collections tabs are empty: Groups and collections are available only on Teams and Enterprise plans. On other plans these tabs stay empty. The tabs are also empty when the organization has no groups or collections defined. If Bitwarden doesn't return this data for the API key, Liongard treats it as non-fatal: the inspection still succeeds and the counts show 0.

Inspector FAQs