New Integration: Bitwarden

Description

Add Bitwarden integration to sync vault activity, organization events, member management, and collection data into CORE.

Reference Implementations

Existing Integrations (use as templates)

• integrations/github/ - OAuth-based integration with event tracking
• integrations/linear/ - Organization management patterns
• integrations/slack/ - For reference

Required Files Structure

integrations/bitwarden/
├── src/
│   ├── index.ts          # Main entry, API spec
│   ├── schedule.ts       # Sync logic
│   ├── utils.ts          # Bitwarden API utilities
│   ├── account-create.ts # Auth setup
│   └── create-activity.ts # Activity formatting
├── package.json
├── tsup.config.ts
└── README.md

Bitwarden API Integration

OAuth Setup

• Use API Key authentication (Client ID + Client Secret)
• Bitwarden provides two APIs:
  • Public API (Organization management): https://api.bitwarden.com/public/
  • Vault Management API: https://api.bitwarden.com/
• Authentication: OAuth 2.0 Client Credentials Grant
  • Token URL: https://identity.bitwarden.com/connect/token
  • Grant type: client_credentials
  • Scope: api.organization
• For self-hosted: Replace bitwarden.com with your domain
• Personal API keys available for individual vault access

Key Endpoints (Public API)

• GET /public/members - List organization members
• GET /public/members/{id} - Get member details
• GET /public/collections - List collections
• GET /public/collections/{id} - Get collection details
• GET /public/groups - List groups
• GET /public/groups/{id} - Get group details
• GET /public/events - List organization events
• GET /public/policies - List policies
• GET /public/organization/subscription - Get subscription info

Events to Track

1. Member Activity

   • Member invited, accepted, confirmed, removed
   • Member role changes
   • Member 2FA status changes
   • SSO login events

2. Vault & Collections

   • Collection created, updated, deleted
   • Items shared to collections
   • Group membership changes
   • Policy updates

3. Organization Events

   • Organization setting changes
   • Subscription updates
   • Security audit events
   • Failed login attempts

Implementation Tasks

• Set up basic integration structure following integrations/github/src/index.ts pattern
• Implement Client Credentials OAuth flow in account-create.ts
• Create Bitwarden API utilities in utils.ts
• Implement sync logic in schedule.ts using events endpoint
• Convert Bitwarden events to CORE activity format
• Add error handling and rate limiting
• Create integration documentation
• Add to integrations/README.md

Technical Notes

• The Public API is OAS3 compliant with a Swagger UI available at https://bitwarden.com/help/api/.
• The Public API is for organization-level management only; it cannot manage individual vault items.
• For individual vault management, use the Vault Management API with a personal API key.
• Authentication tokens obtained via Client Credentials grant have a limited lifetime; implement token refresh.
• Self-hosted Bitwarden instances use different base URLs (e.g., https://your.domain.com/api/).
• API responses now include SSO external identifiers for organization members.
• Event logs provide comprehensive audit trail data for compliance.
• Security consideration: This integration should never store or sync actual vault item contents (passwords, notes, etc.).

Resources

• Bitwarden Public API Documentation
• Bitwarden APIs Overview
• Bitwarden Personal API Key
• Bitwarden Contributing - Public API
• Bitwarden Server (GitHub)

Labels

enhancement, integration, new-feature