Repository: CVEProject/cve-services
Pull request #1046 (2023-03-15 14:08:05)

Updating Prod-staging v2.1.3
Updates Prod-staging to v2.1.3 for next Prod deploy.


Patch:
diff --git a/api-docs/openapi.json b/api-docs/openapi.json
index bbea4b8f..c76bb604 100644
--- a/api-docs/openapi.json
+++ b/api-docs/openapi.json
@@ -1,7 +1,7 @@
 {
   "openapi": "3.0.2",
   "info": {
-    "version": "2.1.2",
+    "version": "2.1.3",
     "title": "CVE Services API",
     "description": "The CVE Services API supports automation tooling for the CVE Program. Credentials are     required for most service endpoints. Representatives of     <a href='https://www.cve.org/ProgramOrganization/CNAs'>CVE Numbering Authorities (CNAs)</a> should     use one of the methods below to obtain credentials:    <ul><li>If your organization already has an Organizational Administrator (OA) account for the CVE     Services, ask your admin for credentials</li>     <li>Contact your Root (<a href='https://www.cve.org/PartnerInformation/ListofPartners/partner/Google'>Google</a>,     <a href='https://www.cve.org/PartnerInformation/ListofPartners/partner/INCIBE'>INCIBE</a>,     <a href='https://www.cve.org/PartnerInformation/ListofPartners/partner/jpcert'>JPCERT/CC</a>, or     <a href='https://www.cve.org/PartnerInformation/ListofPartners/partner/redhat'>Red Hat</a>) or     Top-Level Root (<a href='https://www.cve.org/PartnerInformation/ListofPartners/partner/icscert'>CISA ICS</a>     or <a href='https://www.cve.org/PartnerInformation/ListofPartners/partner/mitre'>MITRE</a>) to request credentials     </ul>     <p>CVE data is to be in the JSON 5.0 CVE Record format. Details of the JSON 5.0 schema are     located <a href='https://github.com/CVEProject/cve-schema/tree/master/schema/v5.0' target='_blank'>here</a>.</p>    <a href='https://cveform.mitre.org/' class='link' target='_blank'>Contact the CVE Services team</a>",
     "contact": {
@@ -11,7 +11,7 @@
   },
   "servers": [
     {
-      "url": "https://cveawg-int.mitre.org/api"
+      "url": "https://cveawg-dev.mitre.org/api"
     }
   ],
   "paths": {
@@ -989,6 +989,7 @@
           }
         },
         "requestBody": {
+          "description": "Note: providerMetadata is set by the server. If provided, it will be overwritten.",
           "required": true,
           "content": {
             "application/json": {
@@ -1089,6 +1090,7 @@
           }
         },
         "requestBody": {
+          "description": "Note: providerMetadata is set by the server. If provided, it will be overwritten.",
           "required": true,
           "content": {
             "application/json": {
@@ -1105,8 +1107,8 @@
         "tags": [
           "CVE Record"
         ],
-        "summary": "Creates a reject CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>CNA:</b> Creates a reject CVE Record for a record owned by their organization</p>  <p><b>Secretariat:</b> Creates a reject CVE Record for a record owned by any organization</p>",
+        "summary": "Creates a rejected CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>CNA:</b> Creates a rejected CVE Record for a record owned by their organization</p>  <p><b>Secretariat:</b> Creates a rejected CVE Record for a record owned by any organization</p>",
         "operationId": "cveCnaCreateReject",
         "parameters": [
           {
@@ -1191,6 +1193,7 @@
           }
         },
         "requestBody": {
+          "description": "Note: providerMetadata is set by the server. If provided, it will be overwritten.",
           "required": true,
           "content": {
             "application/json": {
@@ -1205,8 +1208,8 @@
         "tags": [
           "CVE Record"
         ],
-        "summary": "Updates an existing CVE Record with a reject record for the specified ID (accessible to CNAs and Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>CNA:</b> Updates a reject CVE Record for a record owned by their organization</p>  <p><b>Secretariat:</b> Updates a reject CVE Record for a record owned by any organization</p>",
+        "summary": "Updates an existing CVE Record with a rejected record for the specified ID (accessible to CNAs and Secretariat)",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>CNA:</b> Updates a rejected CVE Record for a record owned by their organization</p>  <p><b>Secretariat:</b> Updates a rejected CVE Record for a record owned by any organization</p>",
         "operationId": "cveCnaUpdateReject",
         "parameters": [
           {
@@ -1291,6 +1294,7 @@
           }
         },
         "requestBody": {
+          "description": "Note: providerMetadata is set by the server. If provided, it will be overwritten.",
           "required": true,
           "content": {
             "application/json": {
@@ -2418,9 +2422,7 @@
           "type": "string",
           "enum": [
             "CNA",
-            "SECRETARIAT",
-            "ROOT_CNA",
-            "ADP"
+            "SECRETARIAT"
           ]
         }
       },
@@ -2433,9 +2435,7 @@
           "type": "string",
           "enum": [
             "CNA",
-            "SECRETARIAT",
-            "ROOT_CNA",
-            "ADP"
+            "SECRETARIAT"
           ]
         }
       },
@@ -2566,10 +2566,15 @@
       "cveIdGetFilteredState": {
         "in": "query",
         "name": "state",
-        "description": "Filter by state [RESERVED, PUBLISHED, REJECTED]",
+        "description": "Filter by state ",
         "required": false,
         "schema": {
-          "type": "string"
+          "type": "string",
+          "enum": [
+            "RESERVED",
+            "PUBLISHED",
+            "REJECTED"
+          ]
         }
       },
       "cveIdGetFilteredCveIdYear": {
@@ -2584,7 +2589,7 @@
       "cveIdGetFilteredTimeReservedLt": {
         "in": "query",
         "name": "time_reserved.lt",
-        "description": "Most recent reserved timestamp to retrieve. Include with all requests potentially returning multiple pages of CVE IDs to avoid issues if new IDs are reserved during use.",
+        "description": "Most recent reserved timestamp to retrieve. Include with all requests potentially returning multiple pages of CVE IDs to avoid issues if new IDs are reserved during use. <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ",
         "required": false,
         "schema": {
           "type": "string",
@@ -2594,7 +2599,7 @@
       "cveIdGetFilteredTimeReservedGt": {
         "in": "query",
         "name": "time_reserved.gt",
-        "description": "Earliest CVE ID reserved timestamp to retrieve",
+        "description": "Earliest CVE ID reserved timestamp to retrieve <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ",
         "required": false,
         "schema": {
           "type": "string",
@@ -2604,7 +2609,7 @@
       "cveIdGetFilteredTimeModifiedLt": {
         "in": "query",
         "name": "time_modified.lt",
-        "description": "Most recent modified timestamp to retrieve. Include with all requests using a time_modified.gt filter potentially returning multiple pages of CVE IDs. This will avoid issues if IDs are reserved or modified during use.",
+        "description": "Most recent modified timestamp to retrieve. Include with all requests using a time_modified.gt filter potentially returning multiple pages of CVE IDs. This will avoid issues if IDs are reserved or modified during use.<br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ",
         "required": false,
         "schema": {
           "type": "string",
@@ -2614,7 +2619,7 @@
       "cveIdGetFilteredTimeModifiedGt": {
         "in": "query",
         "name": "time_modified.gt",
-        "description": "Earliest CVE ID modified timestamp to retrieve",
+        "description": "Earliest CVE ID modified timestamp to retrieve <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ",
         "required": false,
         "schema": {
           "type": "string",
@@ -2624,7 +2629,7 @@
       "cveRecordFilteredTimeModifiedLt": {
         "in": "query",
         "name": "time_modified.lt",
-        "description": "Most recent CVE record modified timestamp to retrieve",
+        "description": "Most recent CVE record modified timestamp to retrieve <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ",
         "required": false,
         "schema": {
           "type": "string",
@@ -2634,7 +2639,7 @@
       "cveRecordFilteredTimeModifiedGt": {
         "in": "query",
         "name": "time_modified.gt",
-        "description": "Earliest CVE record modified timestamp to retrieve",
+        "description": "Earliest CVE record modified timestamp to retrieve <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ",
         "required": false,
         "schema": {
           "type": "string",
@@ -2710,7 +2715,7 @@
       "newUsername": {
         "in": "query",
         "name": "new_username",
-        "description": "The new username for the user, preferably the user's email address. Must be 3-50 characters in length; allowed characters are alphanumberic and -_@.",
+        "description": "The new username for the user, preferably the user's email address. Must be 3-128 characters in length; allowed characters are alphanumeric and -_@.",
         "required": false,
         "schema": {
           "type": "string"
@@ -2719,7 +2724,7 @@
       "org": {
         "in": "query",
         "name": "org",
-        "description": "The new owning_cna for the CVE ID",
+        "description": "The shortname of the new owning_cna for the CVE ID",
         "required": false,
         "schema": {
           "type": "string"
@@ -2769,7 +2774,11 @@
         "description": "The new state for the CVE ID",
         "required": false,
         "schema": {
-          "type": "string"
+          "type": "string",
+          "enum": [
+            "RESERVED",
+            "REJECTED"
+          ]
         }
       }
     },
diff --git a/package-lock.json b/package-lock.json
index 29847c71..d6efecfe 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "cve-services",
-    "version": "2.1.1",
+    "version": "2.1.3",
     "lockfileVersion": 2,
     "requires": true,
     "packages": {
         "": {
             "name": "cve-services",
-            "version": "2.1.1",
+            "version": "2.1.3",
             "license": "(CC0)",
             "dependencies": {
                 "ajv": "^8.6.2",
@@ -25,7 +25,7 @@
                 "jsonschema": "^1.4.0",
                 "JSONStream": "^1.3.5",
                 "kleur": "^4.1.4",
-                "mongoose": "^5.12.3",
+                "mongoose": "^5.13.15",
                 "mongoose-aggregate-paginate-v2": "1.0.6",
                 "morgan": "^1.9.1",
                 "node-dev": "^7.4.3",
@@ -52,7 +52,7 @@
                 "depcheck": "^0.9.2",
                 "eslint": "^8.20.0",
                 "eslint-config-standard": "^14.1.1",
-                "eslint-plugin-import": "^2.20.1",
+                "eslint-plugin-import": "^2.26.0",
                 "eslint-plugin-mocha": "^8.0.0",
                 "eslint-plugin-node": "^11.0.0",
                 "eslint-plugin-promise": "^4.2.1",
@@ -2103,9 +2103,9 @@
             "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
         },
         "node_modules/cookiejar": {
-            "version": "2.1.2",
-            "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.2.tgz",
-            "integrity": "sha512-Mw+adcfzPxcPeI+0WlvRrr/3lGVO0bD75SxX6811cxSh1Wbxx7xZBGK1eVtDf6si8rg2lhnUjsVLMFMfbRIuwA==",
+            "version": "2.1.4",
+            "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.4.tgz",
+            "integrity": "sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==",
             "dev": true
         },
         "node_modules/core-util-is": {
@@ -5349,9 +5349,9 @@
             "dev": true
         },
         "node_modules/json5": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-            "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+            "version": "2.2.3",
+            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+            "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
             "bin": {
                 "json5": "lib/cli.js"
             },
@@ -6247,9 +6247,9 @@
             }
         },
         "node_modules/mongoose": {
-            "version": "5.13.14",
-            "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.13.14.tgz",
-            "integrity": "sha512-j+BlQjjxgZg0iWn42kLeZTB91OejcxWpY2Z50bsZTiKJ7HHcEtcY21Godw496GMkBqJMTzmW7G/kZ04mW+Cb7Q==",
+            "version": "5.13.15",
+            "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.13.15.tgz",
+            "integrity": "sha512-cxp1Gbb8yUWkaEbajdhspSaKzAvsIvOtRlYD87GN/P2QEUhpd6bIvebi36T6M0tIVAMauNaK9SPA055N3PwF8Q==",
             "dependencies": {
                 "@types/bson": "1.x || 4.0.x",
                 "@types/mongodb": "^3.5.27",
@@ -9265,9 +9265,9 @@
             }
         },
         "node_modules/tsconfig-paths/node_modules/json5": {
-            "version": "1.0.1",
-            "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-            "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+            "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
             "dev": true,
             "dependencies": {
                 "minimist": "^1.2.0"
@@ -11649,9 +11649,9 @@
             "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
         },
         "cookiejar": {
-            "version": "2.1.2",
-            "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.2.tgz",
-            "integrity": "sha512-Mw+adcfzPxcPeI+0WlvRrr/3lGVO0bD75SxX6811cxSh1Wbxx7xZBGK1eVtDf6si8rg2lhnUjsVLMFMfbRIuwA==",
+            "version": "2.1.4",
+            "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.4.tgz",
+            "integrity": "sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==",
             "dev": true
         },
         "core-util-is": {
@@ -14039,9 +14039,9 @@
             "dev": true
         },
         "json5": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-            "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA=="
+            "version": "2.2.3",
+            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+            "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg=="
         },
         "jsonfile": {
             "version": "6.1.0",
@@ -14708,9 +14708,9 @@
             }
         },
         "mongoose": {
-            "version": "5.13.14",
-            "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.13.14.tgz",
-            "integrity": "sha512-j+BlQjjxgZg0iWn42kLeZTB91OejcxWpY2Z50bsZTiKJ7HHcEtcY21Godw496GMkBqJMTzmW7G/kZ04mW+Cb7Q==",
+            "version": "5.13.15",
+            "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.13.15.tgz",
+            "integrity": "sha512-cxp1Gbb8yUWkaEbajdhspSaKzAvsIvOtRlYD87GN/P2QEUhpd6bIvebi36T6M0tIVAMauNaK9SPA055N3PwF8Q==",
             "requires": {
                 "@types/bson": "1.x || 4.0.x",
                 "@types/mongodb": "^3.5.27",
@@ -16948,9 +16948,9 @@
             },
             "dependencies": {
                 "json5": {
-                    "version": "1.0.1",
-                    "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-                    "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+                    "version": "1.0.2",
+                    "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+                    "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
                     "dev": true,
                     "requires": {
                         "minimist": "^1.2.0"
@@ -17499,4 +17499,4 @@
             "dev": true
         }
     }
-}
+}
\ No newline at end of file
diff --git a/package.json b/package.json
index 9dcfdf2f..34b1ef79 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
     "name": "cve-services",
     "author": "Automation Working Group",
-    "version": "2.1.2",
+    "version": "2.1.3",
     "license": "(CC0)",
     "devDependencies": {
         "apidoc": "^0.53.1",
@@ -15,7 +15,7 @@
         "depcheck": "^0.9.2",
         "eslint": "^8.20.0",
         "eslint-config-standard": "^14.1.1",
-        "eslint-plugin-import": "^2.20.1",
+        "eslint-plugin-import": "^2.26.0",
         "eslint-plugin-mocha": "^8.0.0",
         "eslint-plugin-node": "^11.0.0",
         "eslint-plugin-promise": "^4.2.1",
@@ -41,7 +41,7 @@
         "jsonschema": "^1.4.0",
         "JSONStream": "^1.3.5",
         "kleur": "^4.1.4",
-        "mongoose": "^5.12.3",
+        "mongoose": "^5.13.15",
         "mongoose-aggregate-paginate-v2": "1.0.6",
         "morgan": "^1.9.1",
         "node-dev": "^7.4.3",
diff --git a/schemas/cve/create-cve-record-rejection-request.json b/schemas/cve/create-cve-record-rejection-request.json
index 2590c9d7..f55a4066 100644
--- a/schemas/cve/create-cve-record-rejection-request.json
+++ b/schemas/cve/create-cve-record-rejection-request.json
@@ -2,12 +2,14 @@
     "$schema": "http://json-schema.org/draft-04/schema",
     "type": "object",
     "required": [
-        "cnaContainer",
-        "rejectedReasons"
+        "cnaContainer"
     ],
     "properties": {
         "cnaContainer": {
             "type": "object",
+            "required": [
+                "rejectedReasons"
+            ],
             "properties": {
                 "providerMetadata": {
                     "type": "object",
diff --git a/schemas/cve/cve-record-minimum-request.json b/schemas/cve/cve-record-minimum-request.json
index 974bd9b0..311c5700 100644
--- a/schemas/cve/cve-record-minimum-request.json
+++ b/schemas/cve/cve-record-minimum-request.json
@@ -1,13 +1,13 @@
 {
     "$schema": "http://json-schema.org/draft-04/schema",
     "type": "object",
+    "required":["cnaContainer"],
     "properties": {
         "cnaContainer": {
             "type": "object",
             "required": [
                 "affected",
                 "descriptions",
-                "providerMetadata",
                 "references"
             ],
             "properties": {
diff --git a/schemas/cve/update-cve-record-rejection-request.json b/schemas/cve/update-cve-record-rejection-request.json
index 2590c9d7..f55a4066 100644
--- a/schemas/cve/update-cve-record-rejection-request.json
+++ b/schemas/cve/update-cve-record-rejection-request.json
@@ -2,12 +2,14 @@
     "$schema": "http://json-schema.org/draft-04/schema",
     "type": "object",
     "required": [
-        "cnaContainer",
-        "rejectedReasons"
+        "cnaContainer"
     ],
     "properties": {
         "cnaContainer": {
             "type": "object",
+            "required": [
+                "rejectedReasons"
+            ],
             "properties": {
                 "providerMetadata": {
                     "type": "object",
diff --git a/schemas/user/create-user-request.json b/schemas/user/create-user-request.json
index ed444a56..d5f715ae 100644
--- a/schemas/user/create-user-request.json
+++ b/schemas/user/create-user-request.json
@@ -4,7 +4,7 @@
   "properties": {
     "username": {
       "type": "string",
-      "description": "Preferably the user's email address. Must be 3-50 characters in length; allowed characters are alphanumberic and -_@."
+      "description": "Preferably the user's email address. Must be 3-128 characters in length; allowed characters are alphanumeric and -_@."
     },
     "name": {
       "type": "object",
diff --git a/src/controller/cve-id.controller/cve-id.controller.js b/src/controller/cve-id.controller/cve-id.controller.js
index 111ba84a..943b417a 100644
--- a/src/controller/cve-id.controller/cve-id.controller.js
+++ b/src/controller/cve-id.controller/cve-id.controller.js
@@ -173,7 +173,7 @@ async function reserveCveId (req, res, next) {
     const result = await orgRepo.findOneByShortName(shortName)
     if (!result) {
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization does not exist.' })
-      return res.status(403).json(error.orgDne(shortName))
+      return res.status(403).json(error.orgDne(shortName, 'short_name', 'query'))
     }
 
     const payload = await getPayload(req, result)
@@ -330,7 +330,7 @@ async function modifyCveId (req, res, next) {
 
       if (!orgUUID) {
         logger.info({ uuid: req.ctx.uuid, message: id + ' could not be reassigned to ' + newOrgShortName + ' in MongoDB because it does not exist.' })
-        return res.status(404).json(error.orgDne(newOrgShortName))
+        return res.status(404).json(error.orgDne(newOrgShortName, 'org', 'query'))
       }
 
       cveId.owning_cna = orgUUID
diff --git a/src/controller/cve-id.controller/error.js b/src/controller/cve-id.controller/error.js
index 7433bfb7..b668cd66 100644
--- a/src/controller/cve-id.controller/error.js
+++ b/src/controller/cve-id.controller/error.js
@@ -48,7 +48,7 @@ class CveIdControllerError extends idrErr.IDRError {
   noBatchType () { // cve-id
     const err = {}
     err.error = 'NO_BATCH_TYPE'
-    err.message = 'The batch_type query parameter must be specified when reserving more than one CVE ID [sequential, nonsequential || non-sequential].'
+    err.message = 'The batch_type query parameter must be specified when reserving more than one CVE ID. Available values are: sequential, nonsequential, non-sequential.'
     return err
   }
 
@@ -70,7 +70,7 @@ class CveIdControllerError extends idrErr.IDRError {
   invalidBatchType () { // cve-id
     const err = {}
     err.error = 'INVALID_BATCH_TYPE'
-    err.message = 'The batch_type provided is invalid [null when amount=1, sequential, nonsequential||non-sequential].'
+    err.message = 'The batch_type provided is invalid. Available values are sequential, nonsequential, non-sequential.'
     return err
   }
 
@@ -105,7 +105,7 @@ class CveIdControllerError extends idrErr.IDRError {
   overIdQuota (details) { // cve-id
     const err = {}
     err.error = 'EXCEEDED_ID_QUOTA'
-    err.message = 'The amount requested would exceed the organization\'s ID quota. No more IDs can be reserved until the number of IDs in the Reserved state goes below the ID quota or the ID quota is raised. If you feel you are receiving this message in error, please contact support.'
+    err.message = 'The amount requested would exceed the organization\'s ID quota. No more IDs can be reserved until the number of IDs in the Reserved state goes below the ID quota or the ID quota is raised. If you feel you are receiving this message in error, please contact support here: https://cveform.mitre.org/'
     err.details = details
     return err
   }
diff --git a/src/controller/cve-id.controller/index.js b/src/controller/cve-id.controller/index.js
index 94b1e32e..a271a535 100644
--- a/src/controller/cve-id.controller/index.js
+++ b/src/controller/cve-id.controller/index.js
@@ -87,7 +87,7 @@ router.get('/cve-id',
   mw.validateUser,
   query().custom((query) => { return mw.validateQueryParameterNames(query, ['page', 'state', 'cve_id_year', 'time_reserved.lt', 'time_reserved.gt', 'time_modified.lt', 'time_modified.gt']) }),
   query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
-  query(['state']).optional().isString().trim().escape().customSanitizer(val => { return val.toUpperCase() }).isIn(CHOICES),
+  query(['state']).optional().isString().trim().escape().customSanitizer(val => { return val.toUpperCase() }).isIn(CHOICES).withMessage(errorMsgs.ID_STATES),
   query(['cve_id_year']).optional().isNumeric().matches(/^[0-9]{4}$/),
   query(['time_reserved.lt']).optional().isString().trim().escape().customSanitizer(val => { return toDate(val) }).not().isEmpty().withMessage(errorMsgs.TIMESTAMP_FORMAT),
   query(['time_reserved.gt']).optional().isString().trim().escape().customSanitizer(val => { return toDate(val) }).not().isEmpty().withMessage(errorMsgs.TIMESTAMP_FORMAT),
@@ -340,7 +340,7 @@ router.put('/cve-id/:id',
   mw.onlyCnas,
   param(['id']).isString().matches(CONSTANTS.CVE_ID_REGEX),
   query().custom((query) => { return mw.validateQueryParameterNames(query, ['state', 'org']) }),
-  query(['state']).optional().isString().trim().escape().customSanitizer(val => { return val.toUpperCase() }).isIn(MODIFYTARGETS),
+  query(['state']).optional().isString().trim().escape().customSanitizer(val => { return val.toUpperCase() }).isIn(MODIFYTARGETS).withMessage(errorMsgs.ID_MODIFY_STATES),
   query(['org']).optional().isString().trim().escape(),
   parseError,
   parsePostParams,
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index 430bc8d0..9518c014 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -306,7 +306,7 @@ async function submitCna (req, res, next) {
 
     // create full cve record here
     const owningCna = await orgRepo.findOneByUUID(cveId.owning_cna)
-    const assignerShortName = owningCna?.short_name
+    const assignerShortName = owningCna.short_name
     const cnaContainer = req.ctx.body.cnaContainer
     const dateUpdated = (new Date()).toISOString()
     const additionalCveMetadataFields = {
diff --git a/src/controller/cve.controller/error.js b/src/controller/cve.controller/error.js
index 83ed5ed9..2dba36d8 100644
--- a/src/controller/cve.controller/error.js
+++ b/src/controller/cve.controller/error.js
@@ -70,7 +70,7 @@ class CveControllerError extends idrErr.IDRError {
   unableToStoreCveRecord () { // cve
     const err = {}
     err.error = 'UNABLE_TO_STORE_CVE_RECORD'
-    err.message = 'A problem occurred while saving the CVE Record, ensure that x_ values do not start with $'
+    err.message = 'A problem occurred while saving the CVE Record, ensure field names in x_ objects do not start with $'
     return err
   }
 
diff --git a/src/controller/cve.controller/index.js b/src/controller/cve.controller/index.js
index e18bf3b3..6cc5a96e 100644
--- a/src/controller/cve.controller/index.js
+++ b/src/controller/cve.controller/index.js
@@ -158,8 +158,8 @@ router.get('/cve',
   query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
   query(['time_modified.lt']).optional().isString().trim().escape().customSanitizer(val => { return toDate(val) }).not().isEmpty().withMessage(errorMsgs.TIMESTAMP_FORMAT),
   query(['time_modified.gt']).optional().isString().trim().escape().customSanitizer(val => { return toDate(val) }).not().isEmpty().withMessage(errorMsgs.TIMESTAMP_FORMAT),
-  query(['state']).optional().isString().trim().escape().customSanitizer(val => { return val.toUpperCase() }).isIn(CHOICES),
-  query(['count_only']).optional().isBoolean({ loose: true }),
+  query(['state']).optional().isString().trim().escape().customSanitizer(val => { return val.toUpperCase() }).isIn(CHOICES).withMessage(errorMsgs.CVE_FILTERED_STATES),
+  query(['count_only']).optional().isBoolean({ loose: true }).withMessage(errorMsgs.COUNT_ONLY),
   query(['assigner_short_name']).optional().isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['assigner']).optional().isString().trim().escape().notEmpty(),
   parseError,
@@ -350,6 +350,7 @@ router.post('/cve/:id/cna',
     '#/components/parameters/apiSecretHeader'
   ]
   #swagger.requestBody = {
+    description: 'Note: providerMetadata is set by the server. If provided, it will be overwritten.',
     required: true,
     content: {
       "application/json": {
@@ -434,6 +435,7 @@ router.put('/cve/:id/cna',
     '#/components/parameters/apiSecretHeader'
   ]
   #swagger.requestBody = {
+    description: 'Note: providerMetadata is set by the server. If provided, it will be overwritten.',
     required: true,
     content: {
       "application/json": {
@@ -504,13 +506,13 @@ router.post('/cve/:id/reject',
   /*
   #swagger.tags = ['CVE Record']
   #swagger.operationId = 'cveCnaCreateReject'
-  #swagger.summary = "Creates a reject CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)"
+  #swagger.summary = "Creates a rejected CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)"
   #swagger.description = "
         <h2>Access Control</h2>
         <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>
         <h2>Expected Behavior</h2>
-        <p><b>CNA:</b> Creates a reject CVE Record for a record owned by their organization</p>
-        <p><b>Secretariat:</b> Creates a reject CVE Record for a record owned by any organization</p>"
+        <p><b>CNA:</b> Creates a rejected CVE Record for a record owned by their organization</p>
+        <p><b>Secretariat:</b> Creates a rejected CVE Record for a record owned by any organization</p>"
   #swagger.parameters['id'] = { description: 'The CVE ID for the record being rejected' }
   #swagger.parameters['$ref'] = [
     '#/components/parameters/apiEntityHeader',
@@ -518,6 +520,7 @@ router.post('/cve/:id/reject',
     '#/components/parameters/apiSecretHeader'
   ]
   #swagger.requestBody = {
+    description: 'Note: providerMetadata is set by the server. If provided, it will be overwritten.',
     required: true,
     content: {
       "application/json": {
@@ -589,13 +592,13 @@ router.put('/cve/:id/reject',
   /*
   #swagger.tags = ['CVE Record']
   #swagger.operationId = 'cveCnaUpdateReject'
-  #swagger.summary = "Updates an existing CVE Record with a reject record for the specified ID (accessible to CNAs and Secretariat)"
+  #swagger.summary = "Updates an existing CVE Record with a rejected record for the specified ID (accessible to CNAs and Secretariat)"
   #swagger.description = "
         <h2>Access Control</h2>
         <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>
         <h2>Expected Behavior</h2>
-        <p><b>CNA:</b> Updates a reject CVE Record for a record owned by their organization</p>
-        <p><b>Secretariat:</b> Updates a reject CVE Record for a record owned by any organization</p>"
+        <p><b>CNA:</b> Updates a rejected CVE Record for a record owned by their organization</p>
+        <p><b>Secretariat:</b> Updates a rejected CVE Record for a record owned by any organization</p>"
   #swagger.parameters['id'] = { description: 'The CVE ID for the record being rejected' }
   #swagger.parameters['$ref'] = [
     '#/components/parameters/apiEntityHeader',
@@ -603,6 +606,7 @@ router.put('/cve/:id/reject',
     '#/components/parameters/apiSecretHeader'
   ]
   #swagger.requestBody = {
+    description: 'Note: providerMetadata is set by the server. If provided, it will be overwritten.',
     required: true,
     content: {
       "application/json": {
diff --git a/src/controller/org.controller/error.js b/src/controller/org.controller/error.js
index 795f8f70..bb83e2c3 100644
--- a/src/controller/org.controller/error.js
+++ b/src/controller/org.controller/error.js
@@ -1,10 +1,10 @@
 const idrErr = require('../../utils/error')
 
 class OrgControllerError extends idrErr.IDRError {
-  orgDneParam (shortname) { // org
+  orgDnePathParam (shortname) { // org
     const err = {}
     err.error = 'ORG_DNE_PARAM'
-    err.message = `The '${shortname}' organization designated by the shortname parameter does not exist.`
+    err.message = `The '${shortname}' organization designated by the shortname path parameter does not exist.`
     return err
   }
 
@@ -77,6 +77,13 @@ class OrgControllerError extends idrErr.IDRError {
     err.message = `'${param}' is not a valid parameter.`
     return err
   }
+
+  notAllowedToSelfDemote () {
+    const err = {}
+    err.error = 'NOT_ALLOWED_TO_SELF_DEMOTE'
+    err.message = 'Please have another admin user from your organization change your role.'
+    return err
+  }
 }
 
 module.exports = {
diff --git a/src/controller/org.controller/index.js b/src/controller/org.controller/index.js
index 7951cd2a..884f3954 100644
--- a/src/controller/org.controller/index.js
+++ b/src/controller/org.controller/index.js
@@ -5,6 +5,7 @@ const errorMsgs = require('../../middleware/errorMessages')
 const controller = require('./org.controller')
 const { body, param, query } = require('express-validator')
 const { parseGetParams, parsePostParams, parseError, isOrgRole, isUserRole, isValidUsername } = require('./org.middleware')
+const { toUpperCaseArray, isFlatStringArray } = require('../../middleware/middleware')
 const getConstants = require('../../../src/constants').getConstants
 const CONSTANTS = getConstants()
 
@@ -157,7 +158,10 @@ router.post('/org',
   mw.onlySecretariat,
   body(['short_name']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   body(['name']).isString().trim().escape().notEmpty(),
-  body(['authority.active_roles']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
+  body(['authority.active_roles']).optional()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isOrgRole),
   body(['policies.id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
   parseError,
   parsePostParams,
@@ -310,10 +314,14 @@ router.put('/org/:shortname',
   query(['new_short_name']).optional().isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
   query(['name']).optional().isString().trim().escape().notEmpty(),
-  query(['active_roles.add']).optional().toArray(),
-  query(['active_roles.add']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
-  query(['active_roles.remove']).optional().toArray(),
-  query(['active_roles.remove']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
+  query(['active_roles.add']).optional().toArray()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isOrgRole).withMessage(errorMsgs.ORG_ROLES),
+  query(['active_roles.remove']).optional().toArray()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isOrgRole).withMessage(errorMsgs.ORG_ROLES),
   parseError,
   parsePostParams,
   controller.ORG_UPDATE_SINGLE)
@@ -539,14 +547,17 @@ router.post('/org/:shortname/user',
   mw.onlySecretariatOrAdmin,
   mw.onlyOrgWithRole,
   param(['shortname']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  body(['username']).isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  body(['username']).isString().trim().escape().notEmpty().custom(isValidUsername),
   body(['org_uuid']).optional().isString().trim().escape(),
   body(['uuid']).optional().isString().trim().escape(),
   body(['name.first']).optional().isString().trim().escape(),
   body(['name.last']).optional().isString().trim().escape(),
   body(['name.middle']).optional().isString().trim().escape(),
   body(['name.suffix']).optional().isString().trim().escape(),
-  body(['authority.active_roles']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isUserRole(val) }),
+  body(['authority.active_roles']).optional()
+    .custom(mw.isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isUserRole),
   parseError,
   parsePostParams,
   controller.USER_CREATE_SINGLE)
@@ -619,7 +630,7 @@ router.get('/org/:shortname/user/:username',
   */
   mw.validateUser,
   param(['shortname']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  param(['username']).isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  param(['username']).isString().trim().escape().notEmpty().custom(isValidUsername),
   parseError,
   parseGetParams,
   controller.USER_SINGLE)
@@ -707,18 +718,22 @@ router.put('/org/:shortname/user/:username',
       'name.suffix', 'active_roles.add', 'active_roles.remove'])
   }),
   param(['shortname']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  param(['username']).isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  param(['username']).isString().trim().escape().notEmpty().custom(isValidUsername),
   query(['active']).optional().isBoolean({ loose: true }),
-  query(['new_username']).optional().isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  query(['new_username']).optional().isString().trim().escape().notEmpty().custom(isValidUsername),
   query(['org_short_name']).optional().isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['name.first']).optional().isString().trim().escape(),
   query(['name.last']).optional().isString().trim().escape(),
   query(['name.middle']).optional().isString().trim().escape(),
   query(['name.suffix']).optional().isString().trim().escape(),
-  query(['active_roles.add']).optional().toArray(),
-  query(['active_roles.add']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isUserRole(val) }),
-  query(['active_roles.remove']).optional().toArray(),
-  query(['active_roles.remove']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isUserRole(val) }),
+  query(['active_roles.add']).optional().toArray()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isUserRole).withMessage(errorMsgs.USER_ROLES),
+  query(['active_roles.remove']).optional().toArray()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isUserRole).withMessage(errorMsgs.USER_ROLES),
   parseError,
   parsePostParams,
   controller.USER_UPDATE_SINGLE)
@@ -793,7 +808,7 @@ router.put('/org/:shortname/user/:username/reset_secret',
   mw.validateUser,
   mw.onlyOrgWithRole,
   param(['shortname']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  param(['username']).isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  param(['username']).isString().trim().escape().notEmpty().custom(isValidUsername),
   parseError,
   parsePostParams,
   controller.USER_RESET_SECRET)
diff --git a/src/controller/org.controller/org.controller.js b/src/controller/org.controller/org.controller.js
index 20652bb2..68ee2e94 100644
--- a/src/controller/org.controller/org.controller.js
+++ b/src/controller/org.controller/org.controller.js
@@ -81,7 +81,7 @@ async function getOrg (req, res, next) {
 
     if (!result) { // an empty result can only happen if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: identifier + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(identifier))
+      return res.status(404).json(error.orgDne(identifier, 'identifier', 'path'))
     }
 
     logger.info({ uuid: req.ctx.uuid, message: identifier + ' organization was sent to the user.', org: result })
@@ -117,7 +117,7 @@ async function getUsers (req, res, next) {
 
     if (!orgUUID) {
       logger.info({ uuid: req.ctx.uuid, message: orgShortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(orgShortName))
+      return res.status(404).json(error.orgDnePathParam(orgShortName))
     }
 
     if (orgShortName !== shortName && !isSecretariat) {
@@ -165,7 +165,7 @@ async function getUser (req, res, next) {
     const orgUUID = await orgRepo.getOrgUUID(orgShortName)
     if (!orgUUID) { // the org can only be non-existent if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: orgShortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(orgShortName))
+      return res.status(404).json(error.orgDnePathParam(orgShortName))
     }
 
     const userRepo = req.ctx.repositories.getUserRepository()
@@ -204,7 +204,7 @@ async function getOrgIdQuota (req, res, next) {
     let result = await repo.findOneByShortName(shortName)
     if (!result) { // a null result can only happen if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(shortName))
+      return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
     const returnPayload = {
@@ -331,7 +331,7 @@ async function updateOrg (req, res, next) {
     // org doesn't exist
     if (!org) {
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization could not be updated in MongoDB because it does not exist.' })
-      return res.status(404).json(error.orgDneParam(shortName))
+      return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
     Object.keys(req.ctx.query).forEach(k => {
@@ -394,7 +394,7 @@ async function updateOrg (req, res, next) {
     let result = await orgRepo.updateByOrgUUID(org.UUID, newOrg)
     if (result.n === 0) {
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization could not be updated in MongoDB because it does not exist.' })
-      return res.status(404).json(error.orgDneParam(shortName))
+      return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
     result = await orgRepo.aggregate(agt)
@@ -438,7 +438,7 @@ async function createUser (req, res, next) {
     const orgUUID = await orgRepo.getOrgUUID(orgShortName)
     if (!orgUUID) { // the org can only be non-existent if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: 'The user could not be created because ' + orgShortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(orgShortName))
+      return res.status(404).json(error.orgDnePathParam(orgShortName))
     }
 
     Object.keys(req.ctx.body).forEach(k => {
@@ -546,7 +546,7 @@ async function updateUser (req, res, next) {
 
     if (!orgUUID) {
       logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + shortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(shortName))
+      return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
     if (shortName !== requesterShortName && !isSecretariat) {
@@ -575,7 +575,7 @@ async function updateUser (req, res, next) {
     newUser.name.middle = user.name.middle
     newUser.name.suffix = user.name.suffix
 
-    Object.keys(req.ctx.query).forEach(k => {
+    for (const k in req.ctx.query) {
       const key = k.toLowerCase()
 
       if (key === 'new_username') {
@@ -608,13 +608,17 @@ async function updateUser (req, res, next) {
         }
       } else if (key === 'active_roles.remove') {
         if (Array.isArray(req.ctx.query['active_roles.remove'])) {
-          req.ctx.query['active_roles.remove'].forEach(r => {
+          for (const r of req.ctx.query['active_roles.remove']) {
+            if (r.toLowerCase() === 'admin' && requesterUsername === username && (isAdmin || isSecretariat)) {
+              logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + requesterUsername + ' is an Org Admin changing their own role.' })
+              return res.status(403).json(error.notAllowedToSelfDemote())
+            }
             removeRoles.push(r)
-          })
+          }
           changesRequirePrivilegedRole = true
         }
       }
-    })
+    }
 
     // Check for correct privileges if the requested changes require them
     if (changesRequirePrivilegedRole && !(isAdmin || isSecretariat)) {
@@ -628,7 +632,7 @@ async function updateUser (req, res, next) {
 
       if (!newUser.org_UUID) {
         logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + newOrgShortName + ' organization does not exist.' })
-        return res.status(404).json(error.orgDne(newOrgShortName))
+        return res.status(404).json(error.orgDne(newOrgShortName, 'org_short_name', 'query'))
       }
     }
 
@@ -736,7 +740,7 @@ async function resetSecret (req, res, next) {
     const orgUUID = await orgRepo.getOrgUUID(orgShortName) // userUUID may be null if user does not exist
     if (!orgUUID) {
       logger.info({ uuid: req.ctx.uuid, messsage: orgShortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(orgShortName))
+      return res.status(404).json(error.orgDnePathParam(orgShortName))
     }
 
     if (orgShortName !== requesterShortName && !isSecretariat) {
diff --git a/src/controller/org.controller/org.middleware.js b/src/controller/org.controller/org.middleware.js
index f3ba4e57..3913baeb 100644
--- a/src/controller/org.controller/org.middleware.js
+++ b/src/controller/org.controller/org.middleware.js
@@ -59,7 +59,7 @@ function parseError (req, res, next) {
 function isValidUsername (val) {
   const value = val.match(/^[A-Za-z0-9\-_@.]{3,128}$/)
   if (value == null) {
-    throw new Error('Username should be 3-128 characters. Allowed characters are alphanumberic and -_@.')
+    throw new Error('Username should be 3-128 characters. Allowed characters are alphanumeric and -_@.')
   }
   return true
 }
diff --git a/src/middleware/errorMessages.js b/src/middleware/errorMessages.js
index 864005c4..3ae62275 100644
--- a/src/middleware/errorMessages.js
+++ b/src/middleware/errorMessages.js
@@ -1,6 +1,12 @@
 // Error message strings to be used in controller/index.js files
 
 module.exports = {
+  ORG_ROLES: 'Invalid role. Valid roles are CNA, SECRETARIAT',
+  USER_ROLES: 'Invalid role. Valid role is ADMIN',
   ID_QUOTA: 'The id_quota does not comply with CVE id quota limitations',
+  ID_STATES: 'Invalid CVE ID state. Valid states are: RESERVED, PUBLISHED, REJECTED',
+  ID_MODIFY_STATES: 'Invalid CVE ID state. Valid states are: RESERVED, REJECTED',
+  CVE_FILTERED_STATES: 'Invalid record state. Valid states are: PUBLISHED, REJECTED',
+  COUNT_ONLY: 'Invalid count_only value. Value should be 1, true, or yes to indicate true, or 0, false, or no to indicate false',
   TIMESTAMP_FORMAT: "Bad date, or invalid timestamp format: valid format is yyyy-MM-ddTHH:mm:ss or yyyy-MM-ddTHH:mm:ssZZZZ (to use '+' in timezone offset, encode as '%2B)"
 }
diff --git a/src/middleware/middleware.js b/src/middleware/middleware.js
index 5ddb0727..10256b15 100644
--- a/src/middleware/middleware.js
+++ b/src/middleware/middleware.js
@@ -363,6 +363,54 @@ const limiter = rateLimit({
   message: error.tooManyRequests()
 })
 
+/**
+ * Ensures value is a flat (one-dimensional) array of any length with values
+ * that are safe to cast to a string
+ *
+ * @param {Any} val
+ * @returns
+ */
+function isFlatStringArray (val) {
+  const errorMsg = 'Parameter must be a one-dimensional array of strings'
+
+  if (!Array.isArray(val)) {
+    throw new Error(errorMsg)
+  }
+
+  const validTypes = [
+    'boolean', 'number', 'bigint', 'string'
+  ]
+
+  for (const k of val) {
+    if (!validTypes.includes(typeof k)) {
+      throw new Error(errorMsg)
+    }
+  }
+
+  return true
+}
+
+/**
+ * Recursively casts to strings and upper-cases all items in array
+ *
+ * @param {Array} val
+ */
+function toUpperCaseArray (val) {
+  if (!Array.isArray(val)) {
+    return val.toString().toUpperCase()
+  }
+
+  const newArr = val.map(k => {
+    if (Array.isArray(k)) {
+      return toUpperCaseArray(k)
+    } else {
+      return k.toString().toUpperCase()
+    }
+  })
+
+  return newArr
+}
+
 module.exports = {
   setCacheControl,
   optionallyValidateUser,
@@ -378,5 +426,7 @@ module.exports = {
   validateCveJsonSchema,
   errorHandler,
   validateJsonSyntax,
-  rateLimiter: limiter
+  rateLimiter: limiter,
+  isFlatStringArray,
+  toUpperCaseArray
 }
diff --git a/src/model/cve.js b/src/model/cve.js
index ad10a7e8..93bab206 100644
--- a/src/model/cve.js
+++ b/src/model/cve.js
@@ -86,7 +86,10 @@ CveSchema.statics.newRejectedCve = function (cveIdObj, reqBody, owningCnaShortNa
   rejectedRecord.cveMetadata.dateReserved = new Date(cveIdObj.reserved).toISOString()
   rejectedRecord.cveMetadata.dateUpdated = providerMetadata.dateUpdated
   rejectedRecord.cveMetadata.dateRejected = providerMetadata.dateUpdated
-  rejectedRecord.cveMetadata.assignerShortName = owningCnaShortName || null
+
+  if (owningCnaShortName) {
+    rejectedRecord.cveMetadata.assignerShortName = owningCnaShortName
+  }
 
   const cnaRejectedContainer = createCnaRejectContainer(providerMetadata, reqBody.cnaContainer.rejectedReasons, reqBody.cnaContainer.replacedBy)
 
diff --git a/src/swagger.js b/src/swagger.js
index 13a38f57..f3c4faae 100644
--- a/src/swagger.js
+++ b/src/swagger.js
@@ -14,7 +14,7 @@ const rejectedCreateCVERecord = require('../schemas/cve/rejected-create-cve-exam
 /* eslint-disable no-multi-str */
 const doc = {
   info: {
-    version: '2.1.2',
+    version: '2.1.3',
     title: 'CVE Services API',
     description: "The CVE Services API supports automation tooling for the CVE Program. Credentials are \
     required for most service endpoints. Representatives of \
@@ -68,9 +68,7 @@ const doc = {
           type: 'string',
           enum: [
             'CNA',
-            'SECRETARIAT',
-            'ROOT_CNA',
-            'ADP'
+            'SECRETARIAT'
           ]
         }
       },
@@ -83,9 +81,7 @@ const doc = {
           type: 'string',
           enum: [
             'CNA',
-            'SECRETARIAT',
-            'ROOT_CNA',
-            'ADP'
+            'SECRETARIAT'
           ]
         }
       },
@@ -216,10 +212,15 @@ const doc = {
       cveIdGetFilteredState: {
         in: 'query',
         name: 'state',
-        description: 'Filter by state [RESERVED, PUBLISHED, REJECTED]',
+        description: 'Filter by state ',
         required: false,
         schema: {
-          type: 'string'
+          type: 'string',
+          enum: [
+            'RESERVED',
+            'PUBLISHED',
+            'REJECTED'
+          ]
         }
       },
       cveIdGetFilteredCveIdYear: {
@@ -235,7 +236,7 @@ const doc = {
       cveIdGetFilteredTimeReservedLt: {
         in: 'query',
         name: 'time_reserved.lt',
-        description: 'Most recent reserved timestamp to retrieve. Include with all requests potentially returning multiple pages of CVE IDs to avoid issues if new IDs are reserved during use.',
+        description: 'Most recent reserved timestamp to retrieve. Include with all requests potentially returning multiple pages of CVE IDs to avoid issues if new IDs are reserved during use. <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ',
         required: false,
         schema: {
           type: 'string',
@@ -245,7 +246,7 @@ const doc = {
       cveIdGetFilteredTimeReservedGt: {
         in: 'query',
         name: 'time_reserved.gt',
-        description: 'Earliest CVE ID reserved timestamp to retrieve',
+        description: 'Earliest CVE ID reserved timestamp to retrieve <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ',
         required: false,
         schema: {
           type: 'string',
@@ -255,7 +256,7 @@ const doc = {
       cveIdGetFilteredTimeModifiedLt: {
         in: 'query',
         name: 'time_modified.lt',
-        description: 'Most recent modified timestamp to retrieve. Include with all requests using a time_modified.gt filter potentially returning multiple pages of CVE IDs. This will avoid issues if IDs are reserved or modified during use.',
+        description: 'Most recent modified timestamp to retrieve. Include with all requests using a time_modified.gt filter potentially returning multiple pages of CVE IDs. This will avoid issues if IDs are reserved or modified during use.<br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ',
         required: false,
         schema: {
           type: 'string',
@@ -265,7 +266,7 @@ const doc = {
       cveIdGetFilteredTimeModifiedGt: {
         in: 'query',
         name: 'time_modified.gt',
-        description: 'Earliest CVE ID modified timestamp to retrieve',
+        description: 'Earliest CVE ID modified timestamp to retrieve <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ',
         required: false,
         schema: {
           type: 'string',
@@ -275,7 +276,7 @@ const doc = {
       cveRecordFilteredTimeModifiedLt: {
         in: 'query',
         name: 'time_modified.lt',
-        description: 'Most recent CVE record modified timestamp to retrieve',
+        description: 'Most recent CVE record modified timestamp to retrieve <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ',
         required: false,
         schema: {
           type: 'string',
@@ -285,7 +286,7 @@ const doc = {
       cveRecordFilteredTimeModifiedGt: {
         in: 'query',
         name: 'time_modified.gt',
-        description: 'Earliest CVE record modified timestamp to retrieve',
+        description: 'Earliest CVE record modified timestamp to retrieve <br><br> <i>Timestamp format</i> : yyyy-MM-ddTHH:mm:ssZZZZ',
         required: false,
         schema: {
           type: 'string',
@@ -361,7 +362,7 @@ const doc = {
       newUsername: {
         in: 'query',
         name: 'new_username',
-        description: 'The new username for the user, preferably the user\'s email address. Must be 3-50 characters in length; allowed characters are alphanumberic and -_@.',
+        description: 'The new username for the user, preferably the user\'s email address. Must be 3-128 characters in length; allowed characters are alphanumeric and -_@.',
         required: false,
         schema: {
           type: 'string'
@@ -370,7 +371,7 @@ const doc = {
       org: {
         in: 'query',
         name: 'org',
-        description: 'The new owning_cna for the CVE ID',
+        description: 'The shortname of the new owning_cna for the CVE ID',
         required: false,
         schema: {
           type: 'string'
@@ -420,7 +421,11 @@ const doc = {
         description: 'The new state for the CVE ID',
         required: false,
         schema: {
-          type: 'string'
+          type: 'string',
+          enum: [
+            'RESERVED',
+            'REJECTED'
+          ]
         }
       }
     },
diff --git a/src/utils/data.js b/src/utils/data.js
index 2cbfac17..5b22f65d 100644
--- a/src/utils/data.js
+++ b/src/utils/data.js
@@ -37,7 +37,7 @@ async function preprocessUserSecrets () {
 
     // provide secret to user in development
     console.log(color.bold().black().bgWhite(
-      'Use the following API secret for all users:') + ' ' +
+      'Use the following API secret for all users added via the populate script:') + ' ' +
       color.bold().black().italic().bgGreen(secretKey)
     )
 
diff --git a/src/utils/error.js b/src/utils/error.js
index bf38db9e..983af32c 100644
--- a/src/utils/error.js
+++ b/src/utils/error.js
@@ -7,10 +7,10 @@ class IDRError {
     return err
   }
 
-  orgDne (shortname) { // super
+  orgDne (shortname, paramName, paramType) { // super
     const err = {}
     err.error = 'ORG_DNE'
-    err.message = `The organization '${shortname}' designated by the shortname query parameter does not exist.`
+    err.message = `The organization '${shortname}' designated by the ${paramName} ${paramType} parameter does not exist.`
     return err
   }
 


Test patch:
diff --git a/test-http/src/test/org_user_tests/org.py b/test-http/src/test/org_user_tests/org.py
index 5547297a..a3ad59ed 100644
--- a/test-http/src/test/org_user_tests/org.py
+++ b/test-http/src/test/org_user_tests/org.py
@@ -7,6 +7,7 @@ import json
 import random
 import requests
 import uuid
+from urllib.parse import urlencode
 from src import env, utils
 from src.utils import (assert_contains, ok_response_contains,
                        ok_response_contains_json, response_contains,
@@ -16,6 +17,43 @@ ORG_URL = '/api/org'
 MAX_SHORTNAME_LENGTH = 32
 #### GET /org ####
 
+ROLES_BAD_VALUES = [
+    # sending an object / assoc array
+    # username=bob&authority.active_roles[a]=b
+    { 'a': 'ADMIN' },
+
+    # sending multi-dimensional arrays
+    # username=bob&authority.active_roles[][a]=b
+    [{ 'a': 'ADMIN' }],
+    [[ 'ADMIN' ]]
+]
+
+ROLES_BAD_QUERY_VALUES = [
+    # valid: single value
+    # "active_roles.add=CNA",
+    
+    # valid: ['CNA']
+    # "active_roles.add[]=CNA",
+    
+    # valid: ['CNA']
+    # "active_roles.add[][]=CNA",
+
+    # valid: ['CNA']
+    # "active_roles.add[8]=CNA"
+
+    # valid: ['CNA', 'CNA']
+    # "active_roles.add[]=CNA&active_roles.add=CNA"
+
+    # bad assoc arrays are caught by valid param checks
+    # "active_roles.add[a]=CNA",
+
+
+    # invalid: [{'a': 'CNA'}]
+    "active_roles.add[][a]=CNA"
+
+    # invalid: [{'CNA': null}]
+    "active_roles.add[][CNA]"
+]
 
 def test_get_all_orgs():
     """ secretariat users can request a list of all organizations """
@@ -71,7 +109,7 @@ def test_get_mitre_by_nonexistent_org_uuid():
         headers=utils.BASE_HEADERS,
     )
     assert res.status_code == 404
-    response_contains_json(res, 'error', 'ORG_DNE_PARAM')
+    response_contains_json(res, 'error', 'ORG_DNE')
 
 
 #### GET /org/:shortname/id_quota ####
@@ -226,6 +264,33 @@ def test_post_new_org_uuid_parameter():
     assert res.status_code == 404
 
 
+def test_post_new_org_malformed_roles():
+    """ service should return useful error message for malformed roles """
+
+    for data in ROLES_BAD_VALUES:
+        uid = str(uuid.uuid4())[:MAX_SHORTNAME_LENGTH]
+
+        res = requests.post(
+            f'{env.AWG_BASE_URL}{ORG_URL}',
+            headers=utils.BASE_HEADERS,
+            json={
+                'short_name': uid,
+                'name': uid,
+                'uuid': str(uuid.uuid4()),
+                'authority': {
+                    'active_roles': data
+                }
+            }
+        )
+
+        assert res.status_code == 400
+        response_contains_json(res, 'message', 'Parameters were invalid')
+        
+        assert res.json()['details'][0]['msg'] == 'Parameter must be a one-dimensional array of strings'
+        assert res.json()['details'][0]['param'] == 'authority.active_roles'
+        assert res.json()['details'][0]['location'] == 'body'
+
+
 #### POST /org/:shortname/user ####
 def test_post_new_org_user():
     """ secretariat user can create a new user without active roles """
@@ -250,6 +315,30 @@ def test_post_new_org_bad_role_blarg():
     response_contains_json(res, 'message', f'{uid} was successfully created.')
 
 
+def test_post_new_org_user_malformed_roles():
+    """ service should return useful error message for malformed roles """
+    uid = str(uuid.uuid4())[:MAX_SHORTNAME_LENGTH]
+
+    for data in ROLES_BAD_VALUES:
+        res = requests.post(
+            f'{env.AWG_BASE_URL}{ORG_URL}/mitre/user',
+            headers=utils.BASE_HEADERS,
+            json={
+                'username': uid,
+                'authority': {
+                    'active_roles': data
+                }
+            }
+        )
+
+        assert res.status_code == 400
+        response_contains_json(res, 'message', 'Parameters were invalid')
+        
+        assert res.json()['details'][0]['msg'] == 'Parameter must be a one-dimensional array of strings'
+        assert res.json()['details'][0]['param'] == 'authority.active_roles'
+        assert res.json()['details'][0]['location'] == 'body'
+
+
 def test_post_new_org_user_empty_body():
     """ an empty new org user body is invalid for username """
     res = requests.post(
@@ -299,8 +388,25 @@ def test_put_update_org_that_does_not_exist():
     )
     assert res.status_code == 404
     response_contains_json(res, 'error', 'ORG_DNE_PARAM')
-    assert_contains(res, 'by the shortname parameter does not exist')
-
+    assert_contains(res, 'by the shortname path parameter does not exist')
+
+
+def test_put_update_mitre_org_malformed_roles():
+    """ service should return useful error message for malformed roles """
+    
+    for data in ROLES_BAD_QUERY_VALUES:
+        res = requests.put(
+            f'{env.AWG_BASE_URL}{ORG_URL}/mitre',
+            headers=utils.BASE_HEADERS,
+            params=data
+        )
+
+        assert res.status_code == 400, str(data)
+        response_contains_json(res, 'message', 'Parameters were invalid')
+        
+        assert res.json()['details'][0]['msg'] == 'Parameter must be a one-dimensional array of strings'
+        assert res.json()['details'][0]['param'] == 'active_roles.add'
+        assert res.json()['details'][0]['location'] == 'query'
 
 def test_put_update_mitre_org_nonexistent_user():
     """ cve services api will fail requests from users that don't exist """
@@ -423,7 +529,7 @@ def test_put_update_user_add_empty_role():
     assert 'MAGNANIMOUS' not in res.content.decode()
     response_contains_json(res, 'error', 'BAD_INPUT')
     response_contains_json(res, 'message', 'Parameters were invalid')
-    response_contains(res, 'User role does not exist.')
+    response_contains(res, 'Invalid role. Valid role')
 
 
 def test_put_update_user_remove_admin_role():
@@ -466,7 +572,34 @@ def test_put_update_user_remove_admin_role():
     assert 'FELLOE' not in res.content.decode()
     response_contains_json(res, 'error', 'BAD_INPUT')
     response_contains_json(res, 'message', 'Parameters were invalid')
-    response_contains(res, 'User role does not exist.')
+    response_contains(res, 'Invalid role. Valid role')
+
+
+def test_put_update_user_malformed_roles():
+    """ service should return useful error message for malformed roles """
+
+    org, user = create_new_user_with_new_org_by_uuid()
+
+    res = requests.put(
+        f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}',
+        headers=utils.BASE_HEADERS,
+        params={'active_roles.add': 'ADMIN'}
+    )
+    assert res.status_code == 200
+    
+    for data in ROLES_BAD_QUERY_VALUES:
+        res = requests.put(
+            f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}',
+            headers=utils.BASE_HEADERS,
+            params=data
+        )
+
+        assert res.status_code == 400, str(data)
+        response_contains_json(res, 'message', 'Parameters were invalid')
+        
+        assert res.json()['details'][0]['msg'] == 'Parameter must be a one-dimensional array of strings'
+        assert res.json()['details'][0]['param'] == 'active_roles.add'
+        assert res.json()['details'][0]['location'] == 'query'
 
 
 #### PUT /org/:shortname/user/:username/reset_secret ####
diff --git a/test-http/src/test/org_user_tests/org_as_org_admin.py b/test-http/src/test/org_user_tests/org_as_org_admin.py
index 4a0b8473..f6ccf6f6 100644
--- a/test-http/src/test/org_user_tests/org_as_org_admin.py
+++ b/test-http/src/test/org_user_tests/org_as_org_admin.py
@@ -455,25 +455,9 @@ def test_org_admin_update_own_user_roles_name(org_admin_headers):
         f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}?active_roles.remove=admin',
         headers=org_admin_headers
     )
-    assert res.status_code == 200
-    assert json.loads(res.content.decode())[
-        'updated']['authority']['active_roles'] == []
-    res = requests.put(
-        # adding role
-        f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}?active_roles.add=admin',
-        headers=org_admin_headers
-    )
     assert res.status_code == 403
-    # cannot add role because org admin doesn't have "ADMIN" role anymore
-    response_contains_json(res, 'error', 'NOT_ORG_ADMIN_OR_SECRETARIAT_UPDATE')
-    res = requests.put(
-        # adding "ADMIN" role back to org admin user
-        f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}?active_roles.add=admin',
-        headers=utils.BASE_HEADERS
-    )
-    assert res.status_code == 200
-    assert json.loads(res.content.decode())[
-        'updated']['authority']['active_roles'] == ["ADMIN"]
+    response_contains_json(res, 'error', 'NOT_ALLOWED_TO_SELF_DEMOTE')
+
     res = requests.put(
         # updating name
         f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}?name.first=t&name.last=e&name.middle=s&name.suffix=t',
diff --git a/test/unit-tests/cve-id/cveIdUpdateTest.js b/test/unit-tests/cve-id/cveIdUpdateTest.js
index 5ac4cbfe..0330bf31 100644
--- a/test/unit-tests/cve-id/cveIdUpdateTest.js
+++ b/test/unit-tests/cve-id/cveIdUpdateTest.js
@@ -166,7 +166,7 @@ describe('Testing the PUT /cve-id/:id endpoint in CveId Controller', () => {
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDne(cveIdFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDne(cveIdFixtures.nonExistentOrg.short_name, 'org', 'query')
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/cve-id/reserveCveId/cveIdReserveGeneralLogicTest.js b/test/unit-tests/cve-id/reserveCveId/cveIdReserveGeneralLogicTest.js
index ba156fa7..bbc1d27f 100644
--- a/test/unit-tests/cve-id/reserveCveId/cveIdReserveGeneralLogicTest.js
+++ b/test/unit-tests/cve-id/reserveCveId/cveIdReserveGeneralLogicTest.js
@@ -279,7 +279,7 @@ describe('Testing the general logic of POST /cve-id endpoint in CveId Controller
 
           expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDne(cveIdFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDne(cveIdFixtures.nonExistentOrg.short_name, 'short_name', 'query')
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/org/orgGetIdQuotaTest.js b/test/unit-tests/org/orgGetIdQuotaTest.js
index cd3f8432..a2630b34 100644
--- a/test/unit-tests/org/orgGetIdQuotaTest.js
+++ b/test/unit-tests/org/orgGetIdQuotaTest.js
@@ -106,7 +106,7 @@ describe('Testing the GET /org/:shortname/id_quota endpoint in Org Controller',
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(orgFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(orgFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/org/orgGetSingleTest.js b/test/unit-tests/org/orgGetSingleTest.js
index 96885739..0a6b77d6 100644
--- a/test/unit-tests/org/orgGetSingleTest.js
+++ b/test/unit-tests/org/orgGetSingleTest.js
@@ -61,7 +61,7 @@ describe('Testing the GET /org/:identifier endpoint in Org Controller', () => {
 
       expect(res).to.have.status(404)
       expect(res).to.have.property('body').and.to.be.a('object')
-      const errObj = error.orgDneParam(orgFixtures.nonExistentOrg.short_name)
+      const errObj = error.orgDne(orgFixtures.nonExistentOrg.short_name, 'identifier', 'path')
       expect(res.body.error).to.equal(errObj.error)
       expect(res.body.message).to.equal(errObj.message)
     })
diff --git a/test/unit-tests/org/orgUpdateTest.js b/test/unit-tests/org/orgUpdateTest.js
index f723e542..f978d6f9 100644
--- a/test/unit-tests/org/orgUpdateTest.js
+++ b/test/unit-tests/org/orgUpdateTest.js
@@ -92,7 +92,7 @@ describe('Testing the PUT /org/:shortname endpoint in Org Controller', () => {
 
       expect(res).to.have.status(404)
       expect(res).to.have.property('body').and.to.be.a('object')
-      const errObj = error.orgDneParam(orgFixtures.nonExistentOrg.short_name)
+      const errObj = error.orgDnePathParam(orgFixtures.nonExistentOrg.short_name)
       expect(res.body.error).to.equal(errObj.error)
       expect(res.body.message).to.equal(errObj.message)
     })
diff --git a/test/unit-tests/user/userCreateTest.js b/test/unit-tests/user/userCreateTest.js
index ec493ae0..7c527104 100644
--- a/test/unit-tests/user/userCreateTest.js
+++ b/test/unit-tests/user/userCreateTest.js
@@ -143,7 +143,7 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(userFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/user/userGetAllTest.js b/test/unit-tests/user/userGetAllTest.js
index a8d02cb2..7cabcabc 100644
--- a/test/unit-tests/user/userGetAllTest.js
+++ b/test/unit-tests/user/userGetAllTest.js
@@ -56,7 +56,7 @@ describe('Testing the GET /org/:shortname/users endpoint in Org Controller', ()
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(orgFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(orgFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/user/userGetSingleTest.js b/test/unit-tests/user/userGetSingleTest.js
index 4b2e5546..47a7cc77 100644
--- a/test/unit-tests/user/userGetSingleTest.js
+++ b/test/unit-tests/user/userGetSingleTest.js
@@ -94,7 +94,7 @@ describe('Testing the GET /org/:shortname/user/:username endpoint in Org Control
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(userFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/user/userResetSecretTest.js b/test/unit-tests/user/userResetSecretTest.js
index 27a48ef7..b2023873 100644
--- a/test/unit-tests/user/userResetSecretTest.js
+++ b/test/unit-tests/user/userResetSecretTest.js
@@ -163,7 +163,7 @@ describe('Testing the PUT /org/:shortname/user/:username/reset_secret endpoint i
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(userFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/user/userUpdateTest.js b/test/unit-tests/user/userUpdateTest.js
index 6002a4cc..54842f9e 100644
--- a/test/unit-tests/user/userUpdateTest.js
+++ b/test/unit-tests/user/userUpdateTest.js
@@ -138,7 +138,7 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(userFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -226,7 +226,7 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDne(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDne(userFixtures.nonExistentOrg.short_name, 'org_short_name', 'query')
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()