{"record":{"id":"b767f4212126efcf","repo":"bitwarden/server","slug":"organizationid-is-required","errorCode":null,"errorMessage":"OrganizationId is required.","messagePattern":"OrganizationId is required\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Dirt/Controllers/OrganizationReportsController.cs","lineNumber":488,"sourceCode":"    private async Task AuthorizeAsync(Guid organizationId)\n    {\n        if (!await _currentContext.AccessReports(organizationId))\n        {\n            throw new NotFoundException();\n        }\n\n        var orgAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(organizationId);\n        if (orgAbility is null || !orgAbility.UseRiskInsights)\n        {\n            throw new BadRequestException(\"Your organization's plan does not support this feature.\");\n        }\n    }\n\n    private static void EnsureValidIds(Guid organizationId, Guid? reportId = null)\n    {\n        if (organizationId == Guid.Empty)\n        {\n            throw new BadRequestException(\"OrganizationId is required.\");\n        }\n\n        if (reportId.HasValue && reportId.Value == Guid.Empty)\n        {\n            throw new BadRequestException(\"ReportId is required.\");\n        }\n    }\n\n    private async Task<OrganizationReport> GetAuthorizedReportAsync(Guid organizationId, Guid reportId)\n    {\n        EnsureValidIds(organizationId, reportId);\n        await AuthorizeAsync(organizationId);\n        var report = await _getOrganizationReportQuery.GetOrganizationReportAsync(reportId);\n        if (report.OrganizationId != organizationId) throw new BadRequestException(\"Invalid report ID\");\n        return report;\n    }\n\n","sourceCodeStart":470,"sourceCodeEnd":506,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Dirt/Controllers/OrganizationReportsController.cs#L470-L506","documentation":"Thrown by the static EnsureValidIds helper when organizationId equals Guid.Empty (00000000-0000-0000-0000-000000000000). This is a request-shape validation guard run before authorization or DB access on every report endpoint that takes an organizationId.","triggerScenarios":"Client sends an empty/default GUID as the organizationId path segment; URL templating produced /reports/organizations/00000000-...; client passed default(Guid) due to a null lookup that defaulted.","commonSituations":"Client failed to resolve the current organization id and defaulted to Guid.Empty; serialization bug writes empty guid; copy-paste of a URL template without substituting the id.","solutions":["Resolve the real organization id before building the request URL and assert it is non-empty.","Add a client-side guard that throws if organizationId == Guid.Empty before calling.","Check the source of the id (e.g. user context, route data) for null/default returns."],"exampleFix":"// before\nvar url = $\"/reports/organizations/{orgId}\"; // orgId may be Guid.Empty\n// after\nif (orgId == Guid.Empty) throw new ArgumentException(\"organizationId required\", nameof(orgId));\nvar url = $\"/reports/organizations/{orgId}\";","handlingStrategy":"validation","validationCode":"if (organizationId == Guid.Empty)\n    throw new ArgumentException(\"organizationId must be a non-empty GUID.\", nameof(organizationId));","typeGuard":"static bool IsValidOrgId(Guid id) => id != Guid.Empty;","tryCatchPattern":"try { await client.GetAsync($\"/reports/organizations/{orgId}\"); }\ncatch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest && ex.Message.Contains(\"OrganizationId\"))\n{ /* resolve the real org id before retrying */ }","preventionTips":["Always resolve organizationId from an authoritative source; never default it.","Assert non-empty GUID before building the request URL.","Watch for null lookups that silently produce Guid.Empty."],"tags":["validation","identifiers","request-shape","csharp","aspnetcore"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}