{"record":{"id":"5b3910a0b130f598","repo":"bitwarden/server","slug":"route-parameter-orgid-or-organizationid-is-mis-5b3910","errorCode":null,"errorMessage":"Route parameter 'orgId' or 'organizationId' is missing or invalid.","messagePattern":"Route parameter 'orgId' or 'organizationId' is missing or invalid\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/AdminConsole/Attributes/InjectOrganizationUserAttribute.cs","lineNumber":67,"sourceCode":"/// </remarks>\npublic class OrganizationUserModelBinder : IModelBinder\n{\n    public async Task BindModelAsync(ModelBindingContext bindingContext)\n    {\n        var defaultMetadata = bindingContext.ModelMetadata as DefaultModelMetadata;\n        var attr = defaultMetadata?.Attributes.ParameterAttributes\n            ?.OfType<InjectOrganizationUserAttribute>()\n            .FirstOrDefault()\n            ?? new InjectOrganizationUserAttribute();\n\n        Guid orgId;\n        try\n        {\n            orgId = bindingContext.HttpContext.GetOrganizationId();\n        }\n        catch (InvalidOperationException)\n        {\n            throw new BadRequestException(\"Route parameter 'orgId' or 'organizationId' is missing or invalid.\");\n        }\n\n        var orgUserId = bindingContext.HttpContext.TryGetRouteParameterAsGuid(attr.OrganizationUserIdRouteParam);\n        if (orgUserId is null)\n        {\n            throw new BadRequestException(\n                $\"Route parameter '{attr.OrganizationUserIdRouteParam}' is missing or invalid.\");\n        }\n\n        var repo = bindingContext.HttpContext.RequestServices\n            .GetRequiredService<IOrganizationUserRepository>();\n\n        var organizationUser = await repo.GetByIdAsync(orgUserId.Value);\n        if (organizationUser is null || organizationUser.OrganizationId != orgId)\n        {\n            throw new NotFoundException();\n        }\n","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Attributes/InjectOrganizationUserAttribute.cs#L49-L85","documentation":"A BadRequestException (HTTP 400) thrown by OrganizationUserModelBinder when the orgId/organizationId route parameter is missing or not a valid GUID, during model binding for an [InjectOrganizationUser] parameter. Identical mechanism to the BindOrganization binder — GetOrganizationId() throws InvalidOperationException which is caught and converted to BadRequestException.","triggerScenarios":"A request to an endpoint with an [InjectOrganizationUser] parameter where the route lacks {orgId}/{organizationId} or the value is malformed. This binder also needs the org ID to validate that the org user belongs to the correct organization.","commonSituations":"Route template was changed during refactoring and no longer includes the org ID segment. Client sends a request with a non-GUID org ID. The controller action was moved to a different route without updating the template.","solutions":["Ensure the route template includes {orgId:guid} or {organizationId:guid}.","Verify the client sends a valid GUID in the org ID route segment.","Confirm the [InjectOrganizationUser] usage is paired with a route that has the org ID parameter.","Check for route conflicts that might match a different template without the org ID."],"exampleFix":"// before: route missing orgId\n[HttpPut(\"{id}/recover\")]\npublic Task<IResult> Recover(Guid id, [InjectOrganizationUser] OrganizationUser user) { ... }\n// after\n[HttpPut(\"{orgId:guid}/{id}/recover\")]\npublic Task<IResult> Recover(Guid orgId, Guid id, [InjectOrganizationUser] OrganizationUser user) { ... }","handlingStrategy":"validation","validationCode":"// Ensure the route has orgId before calling an [InjectOrganizationUser] endpoint\nif (!HttpContext.TryGetRouteParameterAsGuid(\"orgId\").HasValue\n    && !HttpContext.TryGetRouteParameterAsGuid(\"organizationId\").HasValue)\n{\n    return Results.BadRequest(\"orgId or organizationId route parameter is required.\");\n}","typeGuard":"static bool HasOrgIdRoute(HttpContext ctx)\n    => ctx.GetRouteData().Values.ContainsKey(\"orgId\")\n       || ctx.GetRouteData().Values.ContainsKey(\"organizationId\");","tryCatchPattern":"try { /* action with [InjectOrganizationUser] */ }\ncatch (BadRequestException ex) when (ex.Message.Contains(\"orgId\"))\n{ return Results.BadRequest(ex.Message); }","preventionTips":["Pair [InjectOrganizationUser] with route templates that always include {orgId:guid}.","Write route-convention tests asserting org-user endpoints carry an org ID segment.","Review route templates after refactoring to catch missing segments."],"tags":["api","model-binding","routing","validation","http-400"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}