Handle null request body in Organization management POST endpoints

[ruchiralakshan123]

Purpose

Fixes wso2/product-is#24011

Goals

Prevent a NullPointerException (500 Server Error) when a POST request is sent with an empty or null body to the organization management endpoints. Instead, the server should reject the request with a proper 400 Bad Request (client error).

Approach

Added null-checks in addOrganization, addOrganizationDiscoveryAttributes, and isDiscoveryAttributeAvailable methods inside OrganizationManagementService.java before reading values from the incoming request objects.

If the request object is null, we throw a new OrganizationManagementClientException with a descriptive message and error code (ORG-60025), which gets cleanly mapped to 400 Bad Request by OrganizationManagementEndpointUtil.handleClientErrorResponse.

User stories

N/A

Developer Checklist (Mandatory)

• Complete the Developer Checklist in the related product-is issue to track any behavioral change or migration impact.

Release note

Fix 500 server error when posting empty body to organization management endpoints.

Documentation

N/A

Training

N/A

Certification

N/A

Marketing

N/A

Automation tests

• Unit tests
  N/A
• Integration tests

  Details about the test cases and coverage

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? N/A
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

N/A

Related PRs

N/A

Migrations (if applicable)

N/A

Test environment

Verified locally.

Learning

N/A

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 195515e2-60e4-4269-ac7d-11afb170fd0d

📥 Commits

Reviewing files that changed from the base of the PR and between bb56735 and 1e2f970.

📒 Files selected for processing (1)

• components/org.wso2.carbon.identity.api.server.organization.management/org.wso2.carbon.identity.api.server.organization.management.v1/src/main/java/org/wso2/carbon/identity/api/server/organization/management/v1/service/OrganizationManagementService.java

---

📝 Walkthrough

Summary

• Added validation for empty or null request bodies across three Organization Management POST endpoints.
• Such requests now return 400 Bad Request with error code ORG-60025 instead of causing server errors.

Walkthrough

OrganizationManagementService now validates request bodies for three POST endpoints: organization creation, discovery attribute addition, and discovery attribute availability checks. When a request object is null, each endpoint throws an OrganizationManagementClientException with code ORG-60025 instead of continuing request processing.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main fix: handling null request bodies in organization management POST endpoints.
Description check	✅ Passed	The description follows the required template and covers purpose, goals, approach, testing, and release note sections.
Linked Issues check	✅ Passed	The changes address issue #24011 by adding null-body checks and returning a client error instead of a 500 response.
Out of Scope Changes check	✅ Passed	The PR appears scoped to the null request body fix and does not introduce unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}