diff --git a/api/accounts/account.gen.go b/api/accounts/account.gen.go
index 556d78d3b..c68b601a0 100644
--- a/api/accounts/account.gen.go
+++ b/api/accounts/account.gen.go
@@ -143,7 +143,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*AccountRe
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("accounts/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("accounts/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -206,7 +206,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("accounts/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("accounts/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -247,7 +247,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*Account
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("accounts/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("accounts/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/authmethods/authmethods.gen.go b/api/authmethods/authmethods.gen.go
index 5934f95f4..c73bd9fd5 100644
--- a/api/authmethods/authmethods.gen.go
+++ b/api/authmethods/authmethods.gen.go
@@ -149,7 +149,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*AuthMetho
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("auth-methods/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("auth-methods/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -212,7 +212,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("auth-methods/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("auth-methods/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -253,7 +253,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*AuthMet
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("auth-methods/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("auth-methods/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/authtokens/authtokens.gen.go b/api/authtokens/authtokens.gen.go
index e4f1408e2..0c12a9f41 100644
--- a/api/authtokens/authtokens.gen.go
+++ b/api/authtokens/authtokens.gen.go
@@ -98,7 +98,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*AuthToken
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("auth-tokens/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("auth-tokens/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -139,7 +139,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*AuthTok
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("auth-tokens/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("auth-tokens/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/credentiallibraries/credential_library.gen.go b/api/credentiallibraries/credential_library.gen.go
index 7ee533814..b51575e5f 100644
--- a/api/credentiallibraries/credential_library.gen.go
+++ b/api/credentiallibraries/credential_library.gen.go
@@ -144,7 +144,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*Credentia
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("credential-libraries/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("credential-libraries/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -207,7 +207,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("credential-libraries/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("credential-libraries/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -248,7 +248,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*Credent
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("credential-libraries/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("credential-libraries/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/credentialstores/credential_store.gen.go b/api/credentialstores/credential_store.gen.go
index 5c37e8c65..879e10f15 100644
--- a/api/credentialstores/credential_store.gen.go
+++ b/api/credentialstores/credential_store.gen.go
@@ -148,7 +148,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*Credentia
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("credential-stores/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("credential-stores/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -211,7 +211,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("credential-stores/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("credential-stores/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -252,7 +252,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*Credent
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("credential-stores/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("credential-stores/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/groups/group.gen.go b/api/groups/group.gen.go
index f394b92f6..02b99173b 100644
--- a/api/groups/group.gen.go
+++ b/api/groups/group.gen.go
@@ -142,7 +142,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*GroupRead
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("groups/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("groups/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -205,7 +205,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("groups/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("groups/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -246,7 +246,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*GroupDe
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("groups/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("groups/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
@@ -358,7 +358,7 @@ func (c *Client) AddMembers(ctx context.Context, id string, version uint32, memb
 
 	opts.postMap["member_ids"] = memberIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:add-members", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:add-members", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddMembers request: %w", err)
 	}
@@ -424,7 +424,7 @@ func (c *Client) SetMembers(ctx context.Context, id string, version uint32, memb
 
 	opts.postMap["member_ids"] = memberIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:set-members", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:set-members", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetMembers request: %w", err)
 	}
@@ -494,7 +494,7 @@ func (c *Client) RemoveMembers(ctx context.Context, id string, version uint32, m
 
 	opts.postMap["member_ids"] = memberIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:remove-members", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:remove-members", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemoveMembers request: %w", err)
 	}
diff --git a/api/hostcatalogs/host_catalog.gen.go b/api/hostcatalogs/host_catalog.gen.go
index 45c8218be..f2e77e0b7 100644
--- a/api/hostcatalogs/host_catalog.gen.go
+++ b/api/hostcatalogs/host_catalog.gen.go
@@ -153,7 +153,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*HostCatal
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("host-catalogs/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("host-catalogs/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -216,7 +216,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("host-catalogs/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("host-catalogs/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -257,7 +257,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*HostCat
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("host-catalogs/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("host-catalogs/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/hosts/host.gen.go b/api/hosts/host.gen.go
index 33f90ab6a..ca6318f78 100644
--- a/api/hosts/host.gen.go
+++ b/api/hosts/host.gen.go
@@ -148,7 +148,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*HostReadR
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("hosts/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("hosts/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -211,7 +211,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("hosts/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("hosts/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -252,7 +252,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*HostDel
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("hosts/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("hosts/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/hostsets/host_set.gen.go b/api/hostsets/host_set.gen.go
index c46720fdf..13d6894bf 100644
--- a/api/hostsets/host_set.gen.go
+++ b/api/hostsets/host_set.gen.go
@@ -147,7 +147,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*HostSetRe
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("host-sets/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("host-sets/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -210,7 +210,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("host-sets/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("host-sets/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -251,7 +251,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*HostSet
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("host-sets/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("host-sets/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
@@ -363,7 +363,7 @@ func (c *Client) AddHosts(ctx context.Context, id string, version uint32, hostId
 
 	opts.postMap["host_ids"] = hostIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:add-hosts", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:add-hosts", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddHosts request: %w", err)
 	}
@@ -429,7 +429,7 @@ func (c *Client) SetHosts(ctx context.Context, id string, version uint32, hostId
 
 	opts.postMap["host_ids"] = hostIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:set-hosts", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:set-hosts", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetHosts request: %w", err)
 	}
@@ -499,7 +499,7 @@ func (c *Client) RemoveHosts(ctx context.Context, id string, version uint32, hos
 
 	opts.postMap["host_ids"] = hostIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:remove-hosts", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:remove-hosts", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemoveHosts request: %w", err)
 	}
diff --git a/api/managedgroups/managedgroups.gen.go b/api/managedgroups/managedgroups.gen.go
index b023bae23..a8e941984 100644
--- a/api/managedgroups/managedgroups.gen.go
+++ b/api/managedgroups/managedgroups.gen.go
@@ -143,7 +143,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*ManagedGr
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("managed-groups/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("managed-groups/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -206,7 +206,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("managed-groups/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("managed-groups/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -247,7 +247,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*Managed
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("managed-groups/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("managed-groups/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/roles/role.gen.go b/api/roles/role.gen.go
index 145dd3eda..a679e130b 100644
--- a/api/roles/role.gen.go
+++ b/api/roles/role.gen.go
@@ -145,7 +145,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*RoleReadR
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("roles/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("roles/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -208,7 +208,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("roles/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("roles/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -249,7 +249,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*RoleDel
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("roles/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("roles/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
@@ -361,7 +361,7 @@ func (c *Client) AddGrants(ctx context.Context, id string, version uint32, grant
 
 	opts.postMap["grant_strings"] = grantStrings
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:add-grants", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:add-grants", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddGrants request: %w", err)
 	}
@@ -431,7 +431,7 @@ func (c *Client) AddPrincipals(ctx context.Context, id string, version uint32, p
 
 	opts.postMap["principal_ids"] = principalIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:add-principals", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:add-principals", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddPrincipals request: %w", err)
 	}
@@ -497,7 +497,7 @@ func (c *Client) SetGrants(ctx context.Context, id string, version uint32, grant
 
 	opts.postMap["grant_strings"] = grantStrings
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:set-grants", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:set-grants", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetGrants request: %w", err)
 	}
@@ -563,7 +563,7 @@ func (c *Client) SetPrincipals(ctx context.Context, id string, version uint32, p
 
 	opts.postMap["principal_ids"] = principalIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:set-principals", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:set-principals", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetPrincipals request: %w", err)
 	}
@@ -633,7 +633,7 @@ func (c *Client) RemoveGrants(ctx context.Context, id string, version uint32, gr
 
 	opts.postMap["grant_strings"] = grantStrings
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:remove-grants", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:remove-grants", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemoveGrants request: %w", err)
 	}
@@ -703,7 +703,7 @@ func (c *Client) RemovePrincipals(ctx context.Context, id string, version uint32
 
 	opts.postMap["principal_ids"] = principalIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:remove-principals", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:remove-principals", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemovePrincipals request: %w", err)
 	}
diff --git a/api/scopes/scope.gen.go b/api/scopes/scope.gen.go
index ce6c5f0b5..1c40a5689 100644
--- a/api/scopes/scope.gen.go
+++ b/api/scopes/scope.gen.go
@@ -142,7 +142,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*ScopeRead
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("scopes/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("scopes/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -205,7 +205,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("scopes/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("scopes/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -246,7 +246,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*ScopeDe
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("scopes/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("scopes/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
diff --git a/api/sessions/session.gen.go b/api/sessions/session.gen.go
index 5855297f0..b8f91ef0d 100644
--- a/api/sessions/session.gen.go
+++ b/api/sessions/session.gen.go
@@ -107,7 +107,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*SessionRe
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("sessions/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("sessions/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
diff --git a/api/targets/target.gen.go b/api/targets/target.gen.go
index d75621bc5..ca5c961aa 100644
--- a/api/targets/target.gen.go
+++ b/api/targets/target.gen.go
@@ -160,7 +160,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*TargetRea
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("targets/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("targets/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -223,7 +223,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("targets/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("targets/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -264,7 +264,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*TargetD
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("targets/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("targets/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
@@ -370,7 +370,7 @@ func (c *Client) AddCredentialLibraries(ctx context.Context, id string, version
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-credential-libraries", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-credential-libraries", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddCredentialLibraries request: %w", err)
 	}
@@ -434,7 +434,7 @@ func (c *Client) AddCredentialSources(ctx context.Context, id string, version ui
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-credential-sources", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-credential-sources", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddCredentialSources request: %w", err)
 	}
@@ -504,7 +504,7 @@ func (c *Client) AddHostSets(ctx context.Context, id string, version uint32, hos
 
 	opts.postMap["host_set_ids"] = hostSetIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-host-sets", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-host-sets", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddHostSets request: %w", err)
 	}
@@ -574,7 +574,7 @@ func (c *Client) AddHostSources(ctx context.Context, id string, version uint32,
 
 	opts.postMap["host_source_ids"] = hostSourceIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-host-sources", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-host-sources", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddHostSources request: %w", err)
 	}
@@ -638,7 +638,7 @@ func (c *Client) SetCredentialLibraries(ctx context.Context, id string, version
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-credential-libraries", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-credential-libraries", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetCredentialLibraries request: %w", err)
 	}
@@ -702,7 +702,7 @@ func (c *Client) SetCredentialSources(ctx context.Context, id string, version ui
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-credential-sources", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-credential-sources", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetCredentialSources request: %w", err)
 	}
@@ -768,7 +768,7 @@ func (c *Client) SetHostSets(ctx context.Context, id string, version uint32, hos
 
 	opts.postMap["host_set_ids"] = hostSetIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-host-sets", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-host-sets", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetHostSets request: %w", err)
 	}
@@ -834,7 +834,7 @@ func (c *Client) SetHostSources(ctx context.Context, id string, version uint32,
 
 	opts.postMap["host_source_ids"] = hostSourceIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-host-sources", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-host-sources", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetHostSources request: %w", err)
 	}
@@ -898,7 +898,7 @@ func (c *Client) RemoveCredentialLibraries(ctx context.Context, id string, versi
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-credential-libraries", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-credential-libraries", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemoveCredentialLibraries request: %w", err)
 	}
@@ -962,7 +962,7 @@ func (c *Client) RemoveCredentialSources(ctx context.Context, id string, version
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-credential-sources", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-credential-sources", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemoveCredentialSources request: %w", err)
 	}
@@ -1032,7 +1032,7 @@ func (c *Client) RemoveHostSets(ctx context.Context, id string, version uint32,
 
 	opts.postMap["host_set_ids"] = hostSetIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-host-sets", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-host-sets", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemoveHostSets request: %w", err)
 	}
@@ -1102,7 +1102,7 @@ func (c *Client) RemoveHostSources(ctx context.Context, id string, version uint3
 
 	opts.postMap["host_source_ids"] = hostSourceIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-host-sources", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-host-sources", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemoveHostSources request: %w", err)
 	}
diff --git a/api/users/user.gen.go b/api/users/user.gen.go
index e1f8c78b0..36c6d977f 100644
--- a/api/users/user.gen.go
+++ b/api/users/user.gen.go
@@ -146,7 +146,7 @@ func (c *Client) Read(ctx context.Context, id string, opt ...Option) (*UserReadR
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("users/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("users/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Read request: %w", err)
 	}
@@ -209,7 +209,7 @@ func (c *Client) Update(ctx context.Context, id string, version uint32, opt ...O
 
 	opts.postMap["version"] = version
 
-	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("users/%s", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("users/%s", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Update request: %w", err)
 	}
@@ -250,7 +250,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt ...Option) (*UserDel
 
 	opts, apiOpts := getOpts(opt...)
 
-	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("users/%s", id), nil, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("users/%s", url.PathEscape(id)), nil, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Delete request: %w", err)
 	}
@@ -362,7 +362,7 @@ func (c *Client) AddAccounts(ctx context.Context, id string, version uint32, acc
 
 	opts.postMap["account_ids"] = accountIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:add-accounts", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:add-accounts", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating AddAccounts request: %w", err)
 	}
@@ -428,7 +428,7 @@ func (c *Client) SetAccounts(ctx context.Context, id string, version uint32, acc
 
 	opts.postMap["account_ids"] = accountIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:set-accounts", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:set-accounts", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating SetAccounts request: %w", err)
 	}
@@ -498,7 +498,7 @@ func (c *Client) RemoveAccounts(ctx context.Context, id string, version uint32,
 
 	opts.postMap["account_ids"] = accountIds
 
-	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:remove-accounts", id), opts.postMap, apiOpts...)
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:remove-accounts", url.PathEscape(id)), opts.postMap, apiOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error creating RemoveAccounts request: %w", err)
 	}
diff --git a/internal/api/genapi/templates.go b/internal/api/genapi/templates.go
index 57afc13b8..71a6086df 100644
--- a/internal/api/genapi/templates.go
+++ b/internal/api/genapi/templates.go
@@ -29,7 +29,7 @@ func getArgsAndPaths(pluralResource, parentTypeName, action string) (colArg, col
 	if action != "" {
 		action = fmt.Sprintf(":%s", action)
 	}
-	resPath = fmt.Sprintf("fmt.Sprintf(\"%s/%%s%s\", id)", colPath, action)
+	resPath = fmt.Sprintf("fmt.Sprintf(\"%s/%%s%s\", url.PathEscape(id))", colPath, action)
 	return
 }
 
diff --git a/internal/tests/api/accounts/account_test.go b/internal/tests/api/accounts/account_test.go
index 1c4f9197a..428dbf1d9 100644
--- a/internal/tests/api/accounts/account_test.go
+++ b/internal/tests/api/accounts/account_test.go
@@ -285,10 +285,19 @@ func TestErrors(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(u)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = accountClient.Read(tc.Context(), fmt.Sprintf("%s/../", u.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = accountClient.Update(tc.Context(), u.Item.Id, 73, accounts.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	require.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/authmethods/authmethod_test.go b/internal/tests/api/authmethods/authmethod_test.go
index 8097203e2..da4a0c64a 100644
--- a/internal/tests/api/authmethods/authmethod_test.go
+++ b/internal/tests/api/authmethods/authmethod_test.go
@@ -1,6 +1,7 @@
 package authmethods_test
 
 import (
+	"fmt"
 	"net/http"
 	"os"
 	"sync"
@@ -319,10 +320,19 @@ func TestErrors(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(u)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = amClient.Read(tc.Context(), fmt.Sprintf("%s/../", u.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = amClient.Update(tc.Context(), u.Item.Id, 73, authmethods.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	require.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/credentiallibraries/credentiallibrary_test.go b/internal/tests/api/credentiallibraries/credentiallibrary_test.go
index a0fdc0cc4..09baa9d92 100644
--- a/internal/tests/api/credentiallibraries/credentiallibrary_test.go
+++ b/internal/tests/api/credentiallibraries/credentiallibrary_test.go
@@ -137,7 +137,6 @@ func TestCrud(t *testing.T) {
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 }
 
-// TODO: Get better coverage for expected errors and error formats.
 func TestErrors(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
 	tc := controller.NewTestController(t, nil)
@@ -163,10 +162,19 @@ func TestErrors(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(l)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = lClient.Read(tc.Context(), fmt.Sprintf("%s/../", l.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = lClient.Update(tc.Context(), l.Item.Id, 73, credentiallibraries.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	assert.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/credentialstores/credentialstore_test.go b/internal/tests/api/credentialstores/credentialstore_test.go
index 0ba0d3535..a329e96ad 100644
--- a/internal/tests/api/credentialstores/credentialstore_test.go
+++ b/internal/tests/api/credentialstores/credentialstore_test.go
@@ -149,9 +149,16 @@ func TestErrors(t *testing.T) {
 	vs, err := c.Create(tc.Context(), "vault", proj.GetPublicId(), credentialstores.WithName("foo"),
 		credentialstores.WithVaultCredentialStoreAddress(vaultServ.Addr), credentialstores.WithVaultCredentialStoreToken(vaultTok))
 	require.NoError(err)
+	require.NotNil(vs)
+
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = c.Read(tc.Context(), fmt.Sprintf("%s/../", vs.Item.Id))
+	require.Error(err)
 	apiErr := api.AsServerError(err)
-	assert.Nil(apiErr)
-	assert.NotNil(vs)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
 
 	// Updating the wrong version should fail.
 	_, err = c.Update(tc.Context(), vs.Item.Id, 73, credentialstores.WithName("anything"))
diff --git a/internal/tests/api/groups/group_test.go b/internal/tests/api/groups/group_test.go
index b5621c390..6060b2ac9 100644
--- a/internal/tests/api/groups/group_test.go
+++ b/internal/tests/api/groups/group_test.go
@@ -195,10 +195,19 @@ func TestErrors(t *testing.T) {
 			require.NoError(err)
 			assert.NotNil(g)
 
+			// A malformed id is processed as the id and not a different path to the api.
+			_, err = groupClient.Read(tc.Context(), fmt.Sprintf("%s/../", g.Item.Id))
+			require.Error(err)
+			apiErr := api.AsServerError(err)
+			require.NotNil(apiErr)
+			assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+			require.Len(apiErr.Details.RequestFields, 1)
+			assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 			// Updating the wrong version should fail.
 			_, err = groupClient.Update(tc.Context(), g.Item.Id, 73, groups.WithName("anything"))
 			require.Error(err)
-			apiErr := api.AsServerError(err)
+			apiErr = api.AsServerError(err)
 			require.NotNil(apiErr)
 			assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/hostcatalogs/host_catalog_test.go b/internal/tests/api/hostcatalogs/host_catalog_test.go
index b23d1a4b8..04182a744 100644
--- a/internal/tests/api/hostcatalogs/host_catalog_test.go
+++ b/internal/tests/api/hostcatalogs/host_catalog_test.go
@@ -216,10 +216,17 @@ func TestErrors(t *testing.T) {
 
 	hc, err := pc.Create(tc.Context(), "static", proj.GetPublicId(), hostcatalogs.WithName("foo"))
 	require.NoError(err)
-	apiErr := api.AsServerError(err)
-	assert.Nil(apiErr)
 	assert.NotNil(hc)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = pc.Read(tc.Context(), fmt.Sprintf("%s/../", hc.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = pc.Update(tc.Context(), hc.Item.Id, 73, hostcatalogs.WithName("anything"))
 	require.Error(err)
diff --git a/internal/tests/api/hosts/host_test.go b/internal/tests/api/hosts/host_test.go
index 91d7c771a..73802d6de 100644
--- a/internal/tests/api/hosts/host_test.go
+++ b/internal/tests/api/hosts/host_test.go
@@ -199,10 +199,19 @@ func TestErrors(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(h)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = hClient.Read(tc.Context(), fmt.Sprintf("%s/../", h.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = hClient.Update(tc.Context(), h.Item.Id, 73, hosts.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	assert.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/hostsets/host_set_test.go b/internal/tests/api/hostsets/host_set_test.go
index 12c68d677..945802f7e 100644
--- a/internal/tests/api/hostsets/host_set_test.go
+++ b/internal/tests/api/hostsets/host_set_test.go
@@ -287,7 +287,6 @@ func TestCrud(t *testing.T) {
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 }
 
-// TODO: Get better coverage for expected errors and error formats.
 func TestErrors(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
 	tc := controller.NewTestController(t, nil)
@@ -308,10 +307,19 @@ func TestErrors(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(h)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = hClient.Read(tc.Context(), fmt.Sprintf("%s/../", h.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = hClient.Update(tc.Context(), h.Item.Id, 73, hostsets.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	assert.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/managedgroups/managedgroups_test.go b/internal/tests/api/managedgroups/managedgroups_test.go
index 528bce8bd..b5d41f09f 100644
--- a/internal/tests/api/managedgroups/managedgroups_test.go
+++ b/internal/tests/api/managedgroups/managedgroups_test.go
@@ -187,10 +187,19 @@ func TestErrorsOidc(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(u)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = managedgroupClient.Read(tc.Context(), fmt.Sprintf("%s/../", u.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = managedgroupClient.Update(tc.Context(), u.Item.Id, 73, managedgroups.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	require.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/roles/role_test.go b/internal/tests/api/roles/role_test.go
index 99074e556..d607f0e4a 100644
--- a/internal/tests/api/roles/role_test.go
+++ b/internal/tests/api/roles/role_test.go
@@ -285,10 +285,19 @@ func TestErrors(t *testing.T) {
 			require.NoError(err)
 			assert.NotNil(u)
 
+			// A malformed id is processed as the id and not a different path to the api.
+			_, err = roleClient.Read(tc.Context(), fmt.Sprintf("%s/../", u.Item.Id))
+			require.Error(err)
+			apiErr := api.AsServerError(err)
+			require.NotNil(apiErr)
+			assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+			require.Len(apiErr.Details.RequestFields, 1)
+			assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 			// Updating the wrong version should fail.
 			_, err = roleClient.Update(tc.Context(), u.Item.Id, 73, roles.WithName("anything"))
 			require.Error(err)
-			apiErr := api.AsServerError(err)
+			apiErr = api.AsServerError(err)
 			assert.NotNil(apiErr)
 			assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/scopes/scope_test.go b/internal/tests/api/scopes/scope_test.go
index 114bb5e1f..7abadd347 100644
--- a/internal/tests/api/scopes/scope_test.go
+++ b/internal/tests/api/scopes/scope_test.go
@@ -124,10 +124,19 @@ func TestErrors(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(createdProj)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = scps.Read(tc.Context(), fmt.Sprintf("%s/../", createdProj.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = scps.Update(tc.Context(), createdProj.Item.Id, 73, scopes.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	assert.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/targets/target_test.go b/internal/tests/api/targets/target_test.go
index f2d9d7d92..f2b71cdbb 100644
--- a/internal/tests/api/targets/target_test.go
+++ b/internal/tests/api/targets/target_test.go
@@ -272,10 +272,19 @@ func TestSet_Errors(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(tar)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = tarClient.Read(tc.Context(), fmt.Sprintf("%s/../", tar.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = tarClient.Update(tc.Context(), tar.Item.Id, 73, targets.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	assert.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
diff --git a/internal/tests/api/users/user_test.go b/internal/tests/api/users/user_test.go
index f72212787..0e318fa46 100644
--- a/internal/tests/api/users/user_test.go
+++ b/internal/tests/api/users/user_test.go
@@ -181,10 +181,19 @@ func TestErrors(t *testing.T) {
 	require.NoError(err)
 	assert.NotNil(u)
 
+	// A malformed id is processed as the id and not a different path to the api.
+	_, err = userClient.Read(tc.Context(), fmt.Sprintf("%s/../", u.Item.Id))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Response().StatusCode())
+	require.Len(apiErr.Details.RequestFields, 1)
+	assert.Equal(apiErr.Details.RequestFields[0].Name, "id")
+
 	// Updating the wrong version should fail.
 	_, err = userClient.Update(tc.Context(), u.Item.Id, 73, users.WithName("anything"))
 	require.Error(err)
-	apiErr := api.AsServerError(err)
+	apiErr = api.AsServerError(err)
 	assert.NotNil(apiErr)
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())