bitwarden/server · error · BadRequestException

OrganizationId is required.

Error message

OrganizationId is required.

What it means

Thrown by the static EnsureValidIds helper when organizationId equals Guid.Empty (00000000-0000-0000-0000-000000000000). This is a request-shape validation guard run before authorization or DB access on every report endpoint that takes an organizationId.

Solutions

1. Resolve the real organization id before building the request URL and assert it is non-empty.
2. Add a client-side guard that throws if organizationId == Guid.Empty before calling.
3. Check the source of the id (e.g. user context, route data) for null/default returns.

Example fix

// before
var url = $"/reports/organizations/{orgId}"; // orgId may be Guid.Empty
// after
if (orgId == Guid.Empty) throw new ArgumentException("organizationId required", nameof(orgId));
var url = $"/reports/organizations/{orgId}";

if (organizationId == Guid.Empty)
    throw new ArgumentException("organizationId must be a non-empty GUID.", nameof(organizationId));

static bool IsValidOrgId(Guid id) => id != Guid.Empty;

try { await client.GetAsync($"/reports/organizations/{orgId}"); }
catch (HttpRequestException ex) when (ex.StatusCode == HttpStatusCode.BadRequest && ex.Message.Contains("OrganizationId"))
{ /* resolve the real org id before retrying */ }

When it happens

Trigger: Client sends an empty/default GUID as the organizationId path segment; URL templating produced /reports/organizations/00000000-...; client passed default(Guid) due to a null lookup that defaulted.

Common situations: Client failed to resolve the current organization id and defaulted to Guid.Empty; serialization bug writes empty guid; copy-paste of a URL template without substituting the id.

Related errors

• ReportId is required.
• Invalid report ID
• File received does not match expected constraints.
• Invalid content.
• Max file size is 500 MB.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/b767f4212126efcf. Report an issue: GitHub.

Appendix: source

Thrown at src/Api/Dirt/Controllers/OrganizationReportsController.cs:488

    private async Task AuthorizeAsync(Guid organizationId)
    {
        if (!await _currentContext.AccessReports(organizationId))
        {
            throw new NotFoundException();
        }

        var orgAbility = await _organizationAbilityCacheService.GetOrganizationAbilityAsync(organizationId);
        if (orgAbility is null || !orgAbility.UseRiskInsights)
        {
            throw new BadRequestException("Your organization's plan does not support this feature.");
        }
    }

    private static void EnsureValidIds(Guid organizationId, Guid? reportId = null)
    {
        if (organizationId == Guid.Empty)
        {
            throw new BadRequestException("OrganizationId is required.");
        }

        if (reportId.HasValue && reportId.Value == Guid.Empty)
        {
            throw new BadRequestException("ReportId is required.");
        }
    }

    private async Task<OrganizationReport> GetAuthorizedReportAsync(Guid organizationId, Guid reportId)
    {
        EnsureValidIds(organizationId, reportId);
        await AuthorizeAsync(organizationId);
        var report = await _getOrganizationReportQuery.GetOrganizationReportAsync(reportId);
        if (report.OrganizationId != organizationId) throw new BadRequestException("Invalid report ID");
        return report;
    }

View on GitHub (pinned to e93b962371)