{"record":{"id":"909c6d1b04f275e4","repo":"bitwarden/server","slug":"route-parameter-attr-organizationuseridroutepara","errorCode":null,"errorMessage":"Route parameter '{attr.OrganizationUserIdRouteParam}' is missing or invalid.","messagePattern":"Route parameter '(.+?)' is missing or invalid\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/AdminConsole/Attributes/InjectOrganizationUserAttribute.cs","lineNumber":73,"sourceCode":"        var attr = defaultMetadata?.Attributes.ParameterAttributes\n            ?.OfType<InjectOrganizationUserAttribute>()\n            .FirstOrDefault()\n            ?? new InjectOrganizationUserAttribute();\n\n        Guid orgId;\n        try\n        {\n            orgId = bindingContext.HttpContext.GetOrganizationId();\n        }\n        catch (InvalidOperationException)\n        {\n            throw new BadRequestException(\"Route parameter 'orgId' or 'organizationId' is missing or invalid.\");\n        }\n\n        var orgUserId = bindingContext.HttpContext.TryGetRouteParameterAsGuid(attr.OrganizationUserIdRouteParam);\n        if (orgUserId is null)\n        {\n            throw new BadRequestException(\n                $\"Route parameter '{attr.OrganizationUserIdRouteParam}' is missing or invalid.\");\n        }\n\n        var repo = bindingContext.HttpContext.RequestServices\n            .GetRequiredService<IOrganizationUserRepository>();\n\n        var organizationUser = await repo.GetByIdAsync(orgUserId.Value);\n        if (organizationUser is null || organizationUser.OrganizationId != orgId)\n        {\n            throw new NotFoundException();\n        }\n\n        bindingContext.Result = ModelBindingResult.Success(organizationUser);\n    }\n}\n","sourceCodeStart":55,"sourceCodeEnd":89,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/AdminConsole/Attributes/InjectOrganizationUserAttribute.cs#L55-L89","documentation":"A BadRequestException (HTTP 400) thrown by OrganizationUserModelBinder when the organization-user ID route parameter (default 'id', configurable via the attribute constructor) is missing or cannot be parsed as a GUID. The binder uses TryGetRouteParameterAsGuid to read the param and throws if the result is null.","triggerScenarios":"A request to an [InjectOrganizationUser] endpoint where the route value for the org user ID parameter (named by OrganizationUserIdRouteParam, default 'id') is absent, empty, or not a GUID.","commonSituations":"The route template uses a different parameter name than the attribute expects (e.g., route has {organizationUserId} but the attribute was applied without specifying that name). A client omits the ID from the URL. The ID is passed as a query parameter instead of a route segment.","solutions":["Ensure the route template includes the org user ID segment with the correct parameter name (default 'id').","If the route uses a non-default name (e.g., 'organizationUserId'), pass it to the attribute: [InjectOrganizationUser(\"organizationUserId\")].","Verify the client sends a valid GUID in the correct URL segment.","Check that the ID is not being sent as a query string or body field instead of a route value."],"exampleFix":"// before: route uses 'organizationUserId' but attribute defaults to 'id'\n[HttpPost(\"{organizationUserId:guid}/accept\")]\npublic Task<IResult> Accept(Guid organizationUserId,\n    [InjectOrganizationUser] OrganizationUser user) { ... }\n// after: tell the binder which route param to read\n[HttpPost(\"{organizationUserId:guid}/accept\")]\npublic Task<IResult> Accept(Guid organizationUserId,\n    [InjectOrganizationUser(\"organizationUserId\")] OrganizationUser user) { ... }","handlingStrategy":"validation","validationCode":"// Ensure the org user ID route param matches the attribute's expected name\nvar routeParamName = \"id\"; // must match [InjectOrganizationUser] constructor arg\nif (!HttpContext.TryGetRouteParameterAsGuid(routeParamName).HasValue)\n{\n    return Results.BadRequest($\"Route parameter '{routeParamName}' is missing or invalid.\");\n}","typeGuard":"static bool HasOrgUserIdRoute(HttpContext ctx, string paramName)\n    => ctx.TryGetRouteParameterAsGuid(paramName).HasValue;","tryCatchPattern":"try { /* action with [InjectOrganizationUser] */ }\ncatch (BadRequestException ex) when (ex.Message.Contains(\"is missing or invalid\"))\n{ return Results.BadRequest(ex.Message); }","preventionTips":["When using a non-default route param name for org user ID, always pass it to [InjectOrganizationUser(\"paramName\")].","Add a unit test for the model binder that verifies it reads the correct route parameter.","Use consistent naming ('id' for the default) across org-user endpoints."],"tags":["api","model-binding","routing","validation","http-400"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}