Flagsmith/flagsmith

API crash because of bad URL parameters

Open

#7361 opened on Apr 28, 2026

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Python (3,475 stars) (264 forks)batch import
good first issueimprovement

Description

Acceptance criteria

  • URL matching or view logic prevents an error with a proper 4xx response.

Sentry Issue: FLAGSMITH-API-5NF

ValueError: invalid literal for int() with base 10: 'org_3COWhASRXfhcdxVrd0wEjpQp4dg'
  File "django/db/models/fields/__init__.py", line 2128, in get_prep_value
    return int(value)

ValueError: Field 'id' expected a number but got 'org_3COWhASRXfhcdxVrd0wEjpQp4dg'.
(17 additional frame(s) were not displayed)
...
  File "features/views.py", line 861, in get_queryset
    return super().get_queryset().filter(identity__pk=self.kwargs["identity_pk"])  # type: ignore[no-untyped-call]

Contributes to #6809

Contributor guide

Tech stack
pythondjangorest api
Domain
backend
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Django viewsURL routing
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
The error occurs in features/views.py line 861 in the get queryset method, where self.kwargs['identity pk'] is passed to filter. This value is expected to be an integer but receives a string (e.g., 'org ...'). Investigate the URL configuration to see how identity pk is captured; it may be matching incorrectly. Ensure that the URL pattern only accepts integer values for identity pk, or add validation in the view to return a 400 response for non integer inputs. Check the URL patterns in urls.py related to this view.