fix(features): return 404 instead of 500 for a non-integer identity ID in the URL

[IshanA2007]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

A non-integer identity ID in the URL crashes the API. GET /api/v1/environments/{api_key}/identities/{identity_pk}/featurestates/ passes identity_pk straight into an ORM filter on an integer field, so a value such as org_3COWhASRXfhcdxVrd0wEjpQp4dg raises an unhandled ValueError and the caller gets a 500 (Sentry FLAGSMITH-API-5NF).

• Listing an identity's feature states now responds 404 for an identity ID that isn't a number, instead of erroring.
• Added a regression test for the non-integer case.

Why 404 rather than 400: the other two actions behind the same URL prefix (/featurestates/all/ and /featurestates/clone-from-given-identity/) already answer 404 for this same value, because DRF's get_object_or_404 converts the ValueError, and BaseFeatureStateViewSet already raises NotFound for an unknown environment_api_key. Returning 400 from list alone would make the endpoint inconsistent with itself. Happy to switch to a 400 ValidationError (as in integrations/github/views.py) if you'd prefer to keep every #6809 fix on 400.

Spotted while working on this and deliberately left alone to keep the PR to one concern: a non-integer ?feature= query parameter on the same endpoint still returns a 500. That looks like another instance of #6809 if you'd like it raised separately.

Closes #7361

Review effort: 1/5

AI disclosure: this change was prepared with the assistance of an AI coding agent (Claude).

How did you test this code?

Added test_list_identity_feature_states__non_integer_identity_pk__returns_404 to api/tests/unit/features/test_unit_features_views.py, asserting a 404 and a {"detail": "Identity not found."} body for both user and master_api_key authentication. Reverting the fix makes it fail with the ValueError from the Sentry trace.

Ran make test opts="tests/unit/features/test_unit_features_views.py -k identity -n0" (44 passed), plus ruff check, ruff format --check and mypy on both changed files.

[vercel]

@IshanA2007 is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 998e2249-f46b-4eaf-bff2-c483d368e259

📥 Commits

Reviewing files that changed from the base of the PR and between a82c3d6 and 1d891c6.

📒 Files selected for processing (2)

• api/features/views.py
• api/tests/unit/features/test_unit_features_views.py

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

IdentityFeatureStateViewSet.get_queryset now converts identity_pk to an integer before filtering. It raises NotFound("Identity not found.") for non-integer values. A unit test verifies a 404 response with the expected response body.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 1d891

The change validates non-integer identity IDs and returns the intended 404 response.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}