bitwarden/server · error · BadRequestException

Route parameter 'orgId' or 'organizationId' is missing or in

Error message

Route parameter 'orgId' or 'organizationId' is missing or invalid.

What it means

A BadRequestException (HTTP 400) thrown by OrganizationModelBinder when neither the 'orgId' nor 'organizationId' route parameter can be resolved as a valid GUID. The binder calls HttpContext.GetOrganizationId() which tries both route values and throws InvalidOperationException if both are missing/invalid; that exception is caught and re-thrown as a BadRequestException with a descriptive message.

Source

Thrown at src/Api/AdminConsole/Attributes/BindOrganizationAttribute.cs:46

/// <summary>
/// Custom model binder that loads an <see cref="Organization"/> from the database
/// using the <c>orgId</c> or <c>organizationId</c> route parameter and binds it to the parameter.
/// </summary>
/// <remarks>
/// This binder is used via the <see cref="BindOrganizationAttribute"/>.
/// </remarks>
public class OrganizationModelBinder : IModelBinder
{
    public async Task BindModelAsync(ModelBindingContext bindingContext)
    {
        Guid orgId;
        try
        {
            orgId = bindingContext.HttpContext.GetOrganizationId();
        }
        catch (InvalidOperationException)
        {
            throw new BadRequestException("Route parameter 'orgId' or 'organizationId' is missing or invalid.");
        }

        var repo = bindingContext.HttpContext.RequestServices
            .GetRequiredService<IOrganizationRepository>();

        var organization = await repo.GetByIdAsync(orgId);
        if (organization is null)
        {
            throw new NotFoundException();
        }

        bindingContext.Result = ModelBindingResult.Success(organization);
    }
}

View on GitHub (pinned to e93b962371)

Solutions

1. Ensure the route template includes {orgId:guid} or {organizationId:guid} and the client sends a valid GUID in that segment.
2. Verify the controller's [Route] attribute and the action's route template both reference the org ID parameter.
3. If using attribute routing, confirm the parameter name in the URL matches 'orgId' or 'organizationId' exactly.
4. Check that the client is not stripping the org ID from the URL (e.g., trailing slash, URL rewriting).

Example fix

// before: route missing orgId
[HttpPost("collections/bulk")]
public async Task<IResult> Bulk([BindOrganization] Organization org) { ... }
// after: route includes orgId
[HttpPost("{orgId:guid}/collections/bulk")]
public async Task<IResult> Bulk([BindOrganization] Organization org) { ... }

// Client-side: ensure orgId is a valid GUID in the URL
if (!Guid.TryParse(orgIdFromUrl, out _))
{
    return BadRequest("orgId must be a valid GUID.");
}

static bool IsValidOrgRouteParam(HttpContext ctx)
    => ctx.TryGetRouteParameterAsGuid("orgId").HasValue
       || ctx.TryGetRouteParameterAsGuid("organizationId").HasValue;

try { await next(); }
catch (BadRequestException ex) when (ex.Message.Contains("orgId") || ex.Message.Contains("organizationId"))
{ return Results.BadRequest(ex.Message); }

When it happens

Trigger: A request to an endpoint using [BindOrganization] where the route template does not include {orgId} or {organizationId}, or the value present is not a valid GUID. Also triggered if the route parameter is present but empty or malformed.

Common situations: An API route is registered without an {orgId} segment but the controller action uses [BindOrganization]. A client sends a request to a URL where the org ID is missing or not a GUID (e.g., a relative path or string slug). A route template mismatch after refactoring.

Related errors

• Route parameter 'orgId' or 'organizationId' is missing or in
• Route parameter '{attr.OrganizationUserIdRouteParam}' is mis
• Requested collections must belong to the same organization.
• Please provide an email and device identifier
• ExternalId cannot exceed 300 characters.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/77c2263ccc28aea3. Report an issue: GitHub.