{"record":{"id":"77c2263ccc28aea3","repo":"bitwarden/server","slug":"route-parameter-orgid-or-organizationid-is-mis","errorCode":null,"errorMessage":"Route parameter 'orgId' or 'organizationId' is missing or invalid.","messagePattern":"Route parameter 'orgId' or 'organizationId' is missing or invalid\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/AdminConsole/Attributes/BindOrganizationAttribute.cs","lineNumber":46,"sourceCode":"/// <summary>\n/// Custom model binder that loads an <see cref=\"Organization\"/> from the database\n/// using the <c>orgId</c> or <c>organizationId</c> route parameter and binds it to the parameter.\n/// </summary>\n/// <remarks>\n/// This binder is used via the <see cref=\"BindOrganizationAttribute\"/>.\n/// </remarks>\npublic class OrganizationModelBinder : IModelBinder\n{\n    public async Task BindModelAsync(ModelBindingContext bindingContext)\n    {\n        Guid orgId;\n        try\n        {\n            orgId = bindingContext.HttpContext.GetOrganizationId();\n        }\n        catch (InvalidOperationException)\n        {\n            throw new BadRequestException(\"Route parameter 'orgId' or 'organizationId' is missing or invalid.\");\n        }\n\n        var repo = bindingContext.HttpContext.RequestServices\n            .GetRequiredService<IOrganizationRepository>();\n\n        var organization = await repo.GetByIdAsync(orgId);\n        if (organization is null)\n        {\n            throw new NotFoundException();\n        }\n\n        bindingContext.Result = ModelBindingResult.Success(organization);\n    }\n}\n","sourceCodeStart":28,"sourceCodeEnd":61,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Attributes/BindOrganizationAttribute.cs#L28-L61","documentation":"A BadRequestException (HTTP 400) thrown by OrganizationModelBinder when neither the 'orgId' nor 'organizationId' route parameter can be resolved as a valid GUID. The binder calls HttpContext.GetOrganizationId() which tries both route values and throws InvalidOperationException if both are missing/invalid; that exception is caught and re-thrown as a BadRequestException with a descriptive message.","triggerScenarios":"A request to an endpoint using [BindOrganization] where the route template does not include {orgId} or {organizationId}, or the value present is not a valid GUID. Also triggered if the route parameter is present but empty or malformed.","commonSituations":"An API route is registered without an {orgId} segment but the controller action uses [BindOrganization]. A client sends a request to a URL where the org ID is missing or not a GUID (e.g., a relative path or string slug). A route template mismatch after refactoring.","solutions":["Ensure the route template includes {orgId:guid} or {organizationId:guid} and the client sends a valid GUID in that segment.","Verify the controller's [Route] attribute and the action's route template both reference the org ID parameter.","If using attribute routing, confirm the parameter name in the URL matches 'orgId' or 'organizationId' exactly.","Check that the client is not stripping the org ID from the URL (e.g., trailing slash, URL rewriting)."],"exampleFix":"// before: route missing orgId\n[HttpPost(\"collections/bulk\")]\npublic async Task<IResult> Bulk([BindOrganization] Organization org) { ... }\n// after: route includes orgId\n[HttpPost(\"{orgId:guid}/collections/bulk\")]\npublic async Task<IResult> Bulk([BindOrganization] Organization org) { ... }","handlingStrategy":"validation","validationCode":"// Client-side: ensure orgId is a valid GUID in the URL\nif (!Guid.TryParse(orgIdFromUrl, out _))\n{\n    return BadRequest(\"orgId must be a valid GUID.\");\n}","typeGuard":"static bool IsValidOrgRouteParam(HttpContext ctx)\n    => ctx.TryGetRouteParameterAsGuid(\"orgId\").HasValue\n       || ctx.TryGetRouteParameterAsGuid(\"organizationId\").HasValue;","tryCatchPattern":"try { await next(); }\ncatch (BadRequestException ex) when (ex.Message.Contains(\"orgId\") || ex.Message.Contains(\"organizationId\"))\n{ return Results.BadRequest(ex.Message); }","preventionTips":["Always include {orgId:guid} or {organizationId:guid} in route templates for org-scoped endpoints.","Add a route convention test that asserts all [BindOrganization] endpoints have an org ID route segment.","Use route constraints (:guid) to fail fast on malformed GUIDs at the routing layer."],"tags":["api","model-binding","routing","validation","http-400"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}