bitwarden/server · error · BadRequestException

OrganizationId is required.

Error message

OrganizationId is required.

What it means

Thrown by the static EnsureValidIds helper when organizationId equals Guid.Empty (00000000-0000-0000-0000-000000000000). This is a request-shape validation guard run before authorization or DB access on every report endpoint that takes an organizationId.

Source

Thrown at src/Api/Dirt/Controllers/OrganizationReportsController.cs:488

    private async Task AuthorizeAsync(Guid organizationId)
    {
        if (!await _currentContext.AccessReports(organizationId))
        {
            throw new NotFoundException();
        }

        var orgAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(organizationId);
        if (orgAbility is null || !orgAbility.UseRiskInsights)
        {
            throw new BadRequestException("Your organization's plan does not support this feature.");
        }
    }

    private static void EnsureValidIds(Guid organizationId, Guid? reportId = null)
    {
        if (organizationId == Guid.Empty)
        {
            throw new BadRequestException("OrganizationId is required.");
        }

        if (reportId.HasValue && reportId.Value == Guid.Empty)
        {
            throw new BadRequestException("ReportId is required.");
        }
    }

    private async Task<OrganizationReport> GetAuthorizedReportAsync(Guid organizationId, Guid reportId)
    {
        EnsureValidIds(organizationId, reportId);
        await AuthorizeAsync(organizationId);
        var report = await _getOrganizationReportQuery.GetOrganizationReportAsync(reportId);
        if (report.OrganizationId != organizationId) throw new BadRequestException("Invalid report ID");
        return report;
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Resolve the real organization id before building the request URL and assert it is non-empty.
2. Add a client-side guard that throws if organizationId == Guid.Empty before calling.
3. Check the source of the id (e.g. user context, route data) for null/default returns.

Example fix

// before
var url = $"/reports/organizations/{orgId}"; // orgId may be Guid.Empty
// after
if (orgId == Guid.Empty) throw new ArgumentException("organizationId required", nameof(orgId));
var url = $"/reports/organizations/{orgId}";

if (organizationId == Guid.Empty)
    throw new ArgumentException("organizationId must be a non-empty GUID.", nameof(organizationId));

static bool IsValidOrgId(Guid id) => id != Guid.Empty;

try { await client.GetAsync($"/reports/organizations/{orgId}"); }
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest && ex.Message.Contains("OrganizationId"))
{ /* resolve the real org id before retrying */ }

When it happens

Trigger: Client sends an empty/default GUID as the organizationId path segment; URL templating produced /reports/organizations/00000000-...; client passed default(Guid) due to a null lookup that defaulted.

Common situations: Client failed to resolve the current organization id and defaulted to Guid.Empty; serialization bug writes empty guid; copy-paste of a URL template without substituting the id.

Related errors

• ReportId is required.
• Invalid report ID
• Max file size is 500 MB.
• ReportFileId is required.
• Resource not found.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/b767f4212126efcf. Report an issue: GitHub.