Merge branch '27988-fix-transient-failure-in-commits-api' into 'master'

Ensure dots in project and group ID are allowed in the API endpoints

Closes #27988

See merge request !9944

59 files changed, 86 insertions, 76 deletions

diff --git a/lib/api/access_requests.rb b/lib/api/access_requests.rb
index 789f45489eb..a5c9f0b509c 100644
--- a/lib/api/access_requests.rb
+++ b/lib/api/access_requests.rb
@@ -10,7 +10,7 @@ module API
       params do
         requires :id, type: String, desc: "The #{source_type} ID"
       end
-      resource source_type.pluralize do
+      resource source_type.pluralize, requirements: { id: %r{[^/]+} } do
         desc "Gets a list of access requests for a #{source_type}." do
           detail 'This feature was introduced in GitLab 8.11.'
           success Entities::AccessRequester
diff --git a/lib/api/award_emoji.rb b/lib/api/award_emoji.rb
index f9e0c2c4e16..56f19f89642 100644
--- a/lib/api/award_emoji.rb
+++ b/lib/api/award_emoji.rb
@@ -9,13 +9,15 @@ module API
       { type: 'snippet', find_by: :id }
     ].freeze
 
-    resource :projects do
+    params do
+      requires :id, type: String, desc: 'The ID of a project'
+    end
+    resource :projects, requirements: { id: %r{[^/]+} } do
       AWARDABLES.each do |awardable_params|
         awardable_string = awardable_params[:type].pluralize
         awardable_id_string = "#{awardable_params[:type]}_#{awardable_params[:find_by]}"
 
         params do
-          requires :id, type: String, desc: 'The ID of a project'
           requires :"#{awardable_id_string}", type: Integer, desc: "The ID of an Issue, Merge Request or Snippet"
         end
 
diff --git a/lib/api/boards.rb b/lib/api/boards.rb
index b6843c1b6af..5a2d7a681e3 100644
--- a/lib/api/boards.rb
+++ b/lib/api/boards.rb
@@ -7,7 +7,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get all project boards' do
         detail 'This feature was introduced in 8.13'
         success Entities::Board
diff --git a/lib/api/branches.rb b/lib/api/branches.rb
index 73a7e939627..2cc64fc6712 100644
--- a/lib/api/branches.rb
+++ b/lib/api/branches.rb
@@ -10,7 +10,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get a project repository branches' do
         success Entities::RepoBranch
       end
diff --git a/lib/api/commit_statuses.rb b/lib/api/commit_statuses.rb
index 9d9f82fdb83..827a38d33da 100644
--- a/lib/api/commit_statuses.rb
+++ b/lib/api/commit_statuses.rb
@@ -2,7 +2,10 @@ require 'mime/types'
 
 module API
   class CommitStatuses < Grape::API
-    resource :projects do
+    params do
+      requires :id, type: String, desc: 'The ID of a project'
+    end
+    resource :projects, requirements: { id: %r{[^/]+} } do
       include PaginationParams
 
       before { authenticate! }
@@ -11,7 +14,6 @@ module API
         success Entities::CommitStatus
       end
       params do
-        requires :id,    type: String, desc: 'The ID of a project'
         requires :sha,   type: String, desc: 'The commit hash'
         optional :ref,   type: String, desc: 'The ref'
         optional :stage, type: String, desc: 'The stage'
@@ -37,7 +39,6 @@ module API
         success Entities::CommitStatus
       end
       params do
-        requires :id,          type: String,  desc: 'The ID of a project'
         requires :sha,         type: String,  desc: 'The commit hash'
         requires :state,       type: String,  desc: 'The state of the status',
                                values: %w(pending running success failed canceled)
diff --git a/lib/api/commits.rb b/lib/api/commits.rb
index 42401abfe0f..66b37fd2bcc 100644
--- a/lib/api/commits.rb
+++ b/lib/api/commits.rb
@@ -10,7 +10,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get a project repository commits' do
         success Entities::RepoCommit
       end
diff --git a/lib/api/deploy_keys.rb b/lib/api/deploy_keys.rb
index 69e85c27a65..b888ede6fe8 100644
--- a/lib/api/deploy_keys.rb
+++ b/lib/api/deploy_keys.rb
@@ -17,7 +17,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of the project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       before { authorize_admin_project }
 
       desc "Get a specific project's deploy keys" do
diff --git a/lib/api/deployments.rb b/lib/api/deployments.rb
index 2f1ad12c38c..46b936897f6 100644
--- a/lib/api/deployments.rb
+++ b/lib/api/deployments.rb
@@ -8,7 +8,7 @@ module API
     params do
       requires :id, type: String, desc: 'The project ID'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get all deployments of the project' do
         detail 'This feature was introduced in GitLab 8.11.'
         success Entities::Deployment
diff --git a/lib/api/environments.rb b/lib/api/environments.rb
index ebe8c3a5b2c..945771d46f3 100644
--- a/lib/api/environments.rb
+++ b/lib/api/environments.rb
@@ -9,7 +9,7 @@ module API
     params do
       requires :id, type: String, desc: 'The project ID'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get all environments of the project' do
         detail 'This feature was introduced in GitLab 8.11.'
         success Entities::Environment
diff --git a/lib/api/files.rb b/lib/api/files.rb
index bb8f5c3076d..33fc970dc09 100644
--- a/lib/api/files.rb
+++ b/lib/api/files.rb
@@ -52,7 +52,7 @@ module API
     params do
       requires :id, type: String, desc: 'The project ID'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get raw file contents from the repository'
       params do
         requires :file_path, type: String, desc: 'The url encoded path to the file. Ex. lib%2Fclass%2Erb'
diff --git a/lib/api/groups.rb b/lib/api/groups.rb
index b862ff70b31..8f3799417e3 100644
--- a/lib/api/groups.rb
+++ b/lib/api/groups.rb
@@ -84,7 +84,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a group'
     end
-    resource :groups do
+    resource :groups, requirements: { id: %r{[^/]+} } do
       desc 'Update a group. Available only for users who can administrate groups.' do
         success Entities::Group
       end
@@ -154,7 +154,7 @@ module API
       params do
         requires :project_id, type: String, desc: 'The ID or path of the project'
       end
-      post ":id/projects/:project_id" do
+      post ":id/projects/:project_id", requirements: { project_id: /.+/ } do
         authenticated_as_admin!
         group = find_group!(params[:id])
         project = find_project!(params[:project_id])
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 1abe8639445..b3183357625 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -58,7 +58,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a group'
     end
-    resource :groups do
+    resource :groups, requirements: { id: %r{[^/]+} } do
       desc 'Get a list of group issues' do
         success Entities::IssueBasic
       end
@@ -79,7 +79,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       include TimeTrackingEndpoints
 
       desc 'Get a list of project issues' do
diff --git a/lib/api/jobs.rb b/lib/api/jobs.rb
index 44118522abe..ffab0aafe59 100644
--- a/lib/api/jobs.rb
+++ b/lib/api/jobs.rb
@@ -7,7 +7,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       helpers do
         params :optional_scope do
           optional :scope, types: [String, Array[String]], desc: 'The scope of builds to show',
diff --git a/lib/api/labels.rb b/lib/api/labels.rb
index 59f0e7cb647..d9a3cb7bb6b 100644
--- a/lib/api/labels.rb
+++ b/lib/api/labels.rb
@@ -7,7 +7,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get all labels of the project' do
         success Entities::Label
       end
diff --git a/lib/api/members.rb b/lib/api/members.rb
index baf85e6075a..c200e46a328 100644
--- a/lib/api/members.rb
+++ b/lib/api/members.rb
@@ -10,7 +10,7 @@ module API
       params do
         requires :id, type: String, desc: "The #{source_type} ID"
       end
-      resource source_type.pluralize do
+      resource source_type.pluralize, requirements: { id: %r{[^/]+} } do
         desc 'Gets a list of group or project members viewable by the authenticated user.' do
           success Entities::Member
         end
diff --git a/lib/api/merge_request_diffs.rb b/lib/api/merge_request_diffs.rb
index a59e39cca26..4b79eac2b8b 100644
--- a/lib/api/merge_request_diffs.rb
+++ b/lib/api/merge_request_diffs.rb
@@ -5,14 +5,16 @@ module API
 
     before { authenticate! }
 
-    resource :projects do
+    params do
+      requires :id, type: String, desc: 'The ID of a project'
+    end
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get a list of merge request diff versions' do
         detail 'This feature was introduced in GitLab 8.12.'
         success Entities::MergeRequestDiff
       end
 
       params do
-        requires :id, type: String, desc: 'The ID of a project'
         requires :merge_request_iid, type: Integer, desc: 'The IID of a merge request'
         use :pagination
       end
@@ -28,7 +30,6 @@ module API
       end
 
       params do
-        requires :id, type: String, desc: 'The ID of a project'
         requires :merge_request_iid, type: Integer, desc: 'The IID of a merge request'
         requires :version_id, type: Integer, desc: 'The ID of a merge request diff version'
       end
diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb
index 7a03955a045..5cc807d5bff 100644
--- a/lib/api/merge_requests.rb
+++ b/lib/api/merge_requests.rb
@@ -7,7 +7,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       include TimeTrackingEndpoints
 
       helpers do
diff --git a/lib/api/milestones.rb b/lib/api/milestones.rb
index abd263c1dfc..e7ab82f08db 100644
--- a/lib/api/milestones.rb
+++ b/lib/api/milestones.rb
@@ -23,7 +23,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get a list of project milestones' do
         success Entities::Milestone
       end
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index 3b3e45cbd06..29ceffdbd2d 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -9,7 +9,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       NOTEABLE_TYPES.each do |noteable_type|
         noteables_str = noteable_type.to_s.underscore.pluralize
 
diff --git a/lib/api/notification_settings.rb b/lib/api/notification_settings.rb
index c5e9b3ad69b..992ea5dc24d 100644
--- a/lib/api/notification_settings.rb
+++ b/lib/api/notification_settings.rb
@@ -48,14 +48,14 @@ module API
     end
 
     %w[group project].each do |source_type|
-      resource source_type.pluralize do
+      params do
+        requires :id, type: String, desc: "The #{source_type} ID"
+      end
+      resource source_type.pluralize, requirements: { id: %r{[^/]+} } do
         desc "Get #{source_type} level notification level settings, defaults to Global" do
           detail 'This feature was introduced in GitLab 8.12'
           success Entities::NotificationSetting
         end
-        params do
-          requires :id, type: String, desc: 'The group ID or project ID or project NAMESPACE/PROJECT_NAME'
-        end
         get ":id/notification_settings" do
           source = find_source(source_type, params[:id])
 
@@ -69,7 +69,6 @@ module API
           success Entities::NotificationSetting
         end
         params do
-          requires :id, type: String, desc: 'The group ID or project ID or project NAMESPACE/PROJECT_NAME'
           optional :level, type: String, desc: "The #{source_type} notification level"
           NotificationSetting::EMAIL_EVENTS.each do |event|
             optional event, type: Boolean, desc: 'Enable/disable this notification'
diff --git a/lib/api/pipelines.rb b/lib/api/pipelines.rb
index 0721b975ba4..754c3d85a04 100644
--- a/lib/api/pipelines.rb
+++ b/lib/api/pipelines.rb
@@ -7,7 +7,7 @@ module API
     params do
       requires :id, type: String, desc: 'The project ID'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get all Pipelines of the project' do
         detail 'This feature was introduced in GitLab 8.11.'
         success Entities::PipelineBasic
diff --git a/lib/api/project_hooks.rb b/lib/api/project_hooks.rb
index 57a5f97dc7f..53791166c33 100644
--- a/lib/api/project_hooks.rb
+++ b/lib/api/project_hooks.rb
@@ -24,7 +24,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get project hooks' do
         success Entities::ProjectHook
       end
diff --git a/lib/api/project_snippets.rb b/lib/api/project_snippets.rb
index f57e7ea4032..cfee38a9baf 100644
--- a/lib/api/project_snippets.rb
+++ b/lib/api/project_snippets.rb
@@ -7,7 +7,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       helpers do
         def handle_project_member_errors(errors)
           if errors[:project_access].any?
diff --git a/lib/api/projects.rb b/lib/api/projects.rb
index 63a4cdd5954..0fbe1669d45 100644
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@@ -142,7 +142,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects, requirements: { id: /[^\/]+/ } do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get a single project' do
         success Entities::ProjectWithAccess
       end
diff --git a/lib/api/repositories.rb b/lib/api/repositories.rb
index 531ef5a63ea..8f16e532ecb 100644
--- a/lib/api/repositories.rb
+++ b/lib/api/repositories.rb
@@ -9,7 +9,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       helpers do
         def handle_project_member_errors(errors)
           if errors[:project_access].any?
diff --git a/lib/api/runners.rb b/lib/api/runners.rb
index 2e41f16f8c6..a77c876a749 100644
--- a/lib/api/runners.rb
+++ b/lib/api/runners.rb
@@ -86,7 +86,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       before { authorize_admin_project }
 
       desc 'Get runners available for project' do
diff --git a/lib/api/services.rb b/lib/api/services.rb
index 5aa2f5eba7b..be614bb8dc0 100644
--- a/lib/api/services.rb
+++ b/lib/api/services.rb
@@ -604,7 +604,10 @@ module API
       ]
     }.freeze
 
-    resource :projects do
+    params do
+      requires :id, type: String, desc: 'The ID of a project'
+    end
+    resource :projects, requirements: { id: %r{[^/]+} } do
       before { authenticate! }
       before { authorize_admin_project }
 
@@ -692,7 +695,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc "Trigger a slash command for #{service_slug}" do
           detail 'Added in GitLab 8.13'
         end
diff --git a/lib/api/subscriptions.rb b/lib/api/subscriptions.rb
index 772b5cca017..dbe54d3cd31 100644
--- a/lib/api/subscriptions.rb
+++ b/lib/api/subscriptions.rb
@@ -12,7 +12,7 @@ module API
       requires :id, type: String, desc: 'The ID of a project'
       requires :subscribable_id, type: String, desc: 'The ID of a resource'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       subscribable_types.each do |type, finder|
         type_singularized = type.singularize
         entity_class = Entities.const_get(type_singularized.camelcase)
diff --git a/lib/api/tags.rb b/lib/api/tags.rb
index d31ef9de26b..c7b1efe0bfa 100644
--- a/lib/api/tags.rb
+++ b/lib/api/tags.rb
@@ -7,7 +7,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get a project repository tags' do
         success Entities::RepoTag
       end
diff --git a/lib/api/todos.rb b/lib/api/todos.rb
index d9b8837a5bb..d1f7e364029 100644
--- a/lib/api/todos.rb
+++ b/lib/api/todos.rb
@@ -12,7 +12,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       ISSUABLE_TYPES.each do |type, finder|
         type_id_str = "#{type.singularize}_iid".to_sym
 
diff --git a/lib/api/triggers.rb b/lib/api/triggers.rb
index 119e9024712..aa3c9a06ed5 100644
--- a/lib/api/triggers.rb
+++ b/lib/api/triggers.rb
@@ -5,7 +5,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Trigger a GitLab project pipeline' do
         success Entities::Pipeline
       end
diff --git a/lib/api/v3/award_emoji.rb b/lib/api/v3/award_emoji.rb
index cf9e1551f60..b96b2d70b12 100644
--- a/lib/api/v3/award_emoji.rb
+++ b/lib/api/v3/award_emoji.rb
@@ -6,7 +6,7 @@ module API
       before { authenticate! }
       AWARDABLES = %w[issue merge_request snippet].freeze
 
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         AWARDABLES.each do |awardable_type|
           awardable_string = awardable_type.pluralize
           awardable_id_string = "#{awardable_type}_id"
diff --git a/lib/api/v3/boards.rb b/lib/api/v3/boards.rb
index b1c2a3c59f2..94acc67171e 100644
--- a/lib/api/v3/boards.rb
+++ b/lib/api/v3/boards.rb
@@ -6,7 +6,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get all project boards' do
           detail 'This feature was introduced in 8.13'
           success ::API::Entities::Board
diff --git a/lib/api/v3/branches.rb b/lib/api/v3/branches.rb
index 699e41b5537..7d9d6246e46 100644
--- a/lib/api/v3/branches.rb
+++ b/lib/api/v3/branches.rb
@@ -9,7 +9,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get a project repository branches' do
           success ::API::Entities::RepoBranch
         end
diff --git a/lib/api/v3/commits.rb b/lib/api/v3/commits.rb
index d254d247042..3414a2883e5 100644
--- a/lib/api/v3/commits.rb
+++ b/lib/api/v3/commits.rb
@@ -11,7 +11,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get a project repository commits' do
           success ::API::Entities::RepoCommit
         end
diff --git a/lib/api/v3/deploy_keys.rb b/lib/api/v3/deploy_keys.rb
index 5bbb167755c..bbb174b6003 100644
--- a/lib/api/v3/deploy_keys.rb
+++ b/lib/api/v3/deploy_keys.rb
@@ -13,7 +13,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of the project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         before { authorize_admin_project }
 
         %w(keys deploy_keys).each do |path|
diff --git a/lib/api/v3/deployments.rb b/lib/api/v3/deployments.rb
index 95114ad1fe1..1d4972eda26 100644
--- a/lib/api/v3/deployments.rb
+++ b/lib/api/v3/deployments.rb
@@ -9,7 +9,7 @@ module API
       params do
         requires :id, type: String, desc: 'The project ID'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get all deployments of the project' do
           detail 'This feature was introduced in GitLab 8.11.'
           success ::API::V3::Deployments
diff --git a/lib/api/v3/environments.rb b/lib/api/v3/environments.rb
index 3056b70e6ef..6bb4e016a01 100644
--- a/lib/api/v3/environments.rb
+++ b/lib/api/v3/environments.rb
@@ -9,7 +9,7 @@ module API
       params do
         requires :id, type: String, desc: 'The project ID'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get all environments of the project' do
           detail 'This feature was introduced in GitLab 8.11.'
           success Entities::Environment
diff --git a/lib/api/v3/files.rb b/lib/api/v3/files.rb
index 4f8d58d37c8..13542b0c71c 100644
--- a/lib/api/v3/files.rb
+++ b/lib/api/v3/files.rb
@@ -40,7 +40,7 @@ module API
       params do
         requires :id, type: String, desc: 'The project ID'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get a file from repository'
         params do
           requires :file_path, type: String, desc: 'The path to the file. Ex. lib/class.rb'
diff --git a/lib/api/v3/groups.rb b/lib/api/v3/groups.rb
index 0aad87a3f58..c5b37622d79 100644
--- a/lib/api/v3/groups.rb
+++ b/lib/api/v3/groups.rb
@@ -93,7 +93,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a group'
       end
-      resource :groups do
+      resource :groups, requirements: { id: %r{[^/]+} } do
         desc 'Update a group. Available only for users who can administrate groups.' do
           success Entities::Group
         end
@@ -163,7 +163,7 @@ module API
         params do
           requires :project_id, type: String, desc: 'The ID or path of the project'
         end
-        post ":id/projects/:project_id" do
+        post ":id/projects/:project_id", requirements: { project_id: /.+/ } do
           authenticated_as_admin!
           group = find_group!(params[:id])
           project = find_project!(params[:project_id])
diff --git a/lib/api/v3/issues.rb b/lib/api/v3/issues.rb
index 258cbfed022..cead03b1e6b 100644
--- a/lib/api/v3/issues.rb
+++ b/lib/api/v3/issues.rb
@@ -68,7 +68,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a group'
       end
-      resource :groups do
+      resource :groups, requirements: { id: %r{[^/]+} } do
         desc 'Get a list of group issues' do
           success ::API::Entities::Issue
         end
@@ -89,7 +89,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         include TimeTrackingEndpoints
 
         desc 'Get a list of project issues' do
diff --git a/lib/api/v3/labels.rb b/lib/api/v3/labels.rb
index 41f45d244e3..bd5eb2175e8 100644
--- a/lib/api/v3/labels.rb
+++ b/lib/api/v3/labels.rb
@@ -6,7 +6,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get all labels of the project' do
           success ::API::Entities::Label
         end
diff --git a/lib/api/v3/members.rb b/lib/api/v3/members.rb
index 3d4972afd9d..684860b553e 100644
--- a/lib/api/v3/members.rb
+++ b/lib/api/v3/members.rb
@@ -11,7 +11,7 @@ module API
         params do
           requires :id, type: String, desc: "The #{source_type} ID"
         end
-        resource source_type.pluralize do
+        resource source_type.pluralize, requirements: { id: %r{[^/]+} } do
           desc 'Gets a list of group or project members viewable by the authenticated user.' do
             success ::API::Entities::Member
           end
diff --git a/lib/api/v3/merge_request_diffs.rb b/lib/api/v3/merge_request_diffs.rb
index a462803e26c..35f462e907b 100644
--- a/lib/api/v3/merge_request_diffs.rb
+++ b/lib/api/v3/merge_request_diffs.rb
@@ -4,14 +4,16 @@ module API
     class MergeRequestDiffs < Grape::API
       before { authenticate! }
 
-      resource :projects do
+      params do
+        requires :id, type: String, desc: 'The ID of a project'
+      end
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get a list of merge request diff versions' do
           detail 'This feature was introduced in GitLab 8.12.'
           success ::API::Entities::MergeRequestDiff
         end
 
         params do
-          requires :id, type: String, desc: 'The ID of a project'
           requires :merge_request_id, type: Integer, desc: 'The ID of a merge request'
         end
 
@@ -27,7 +29,6 @@ module API
         end
 
         params do
-          requires :id, type: String, desc: 'The ID of a project'
           requires :merge_request_id, type: Integer, desc: 'The ID of a merge request'
           requires :version_id, type: Integer, desc: 'The ID of a merge request diff version'
         end
diff --git a/lib/api/v3/merge_requests.rb b/lib/api/v3/merge_requests.rb
index 7dbd4691a94..3077240e650 100644
--- a/lib/api/v3/merge_requests.rb
+++ b/lib/api/v3/merge_requests.rb
@@ -10,7 +10,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         include TimeTrackingEndpoints
 
         helpers do
diff --git a/lib/api/v3/milestones.rb b/lib/api/v3/milestones.rb
index 2a850a08a8a..be90cec4afc 100644
--- a/lib/api/v3/milestones.rb
+++ b/lib/api/v3/milestones.rb
@@ -18,7 +18,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get a list of project milestones' do
           success ::API::Entities::Milestone
         end
diff --git a/lib/api/v3/notes.rb b/lib/api/v3/notes.rb
index 0796bb62e68..4f8e0eff4ff 100644
--- a/lib/api/v3/notes.rb
+++ b/lib/api/v3/notes.rb
@@ -10,7 +10,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         NOTEABLE_TYPES.each do |noteable_type|
           noteables_str = noteable_type.to_s.underscore.pluralize
 
diff --git a/lib/api/v3/pipelines.rb b/lib/api/v3/pipelines.rb
index 2c26a5f7d35..82827249244 100644
--- a/lib/api/v3/pipelines.rb
+++ b/lib/api/v3/pipelines.rb
@@ -8,7 +8,7 @@ module API
       params do
         requires :id, type: String, desc: 'The project ID'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get all Pipelines of the project' do
           detail 'This feature was introduced in GitLab 8.11.'
           success ::API::Entities::Pipeline
diff --git a/lib/api/v3/project_hooks.rb b/lib/api/v3/project_hooks.rb
index 861b991b8e1..94614bfc8b6 100644
--- a/lib/api/v3/project_hooks.rb
+++ b/lib/api/v3/project_hooks.rb
@@ -25,7 +25,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get project hooks' do
           success ::API::V3::Entities::ProjectHook
         end
diff --git a/lib/api/v3/project_snippets.rb b/lib/api/v3/project_snippets.rb
index 809ca4f37ba..fc065a22d74 100644
--- a/lib/api/v3/project_snippets.rb
+++ b/lib/api/v3/project_snippets.rb
@@ -8,7 +8,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         helpers do
           def handle_project_member_errors(errors)
             if errors[:project_access].any?
diff --git a/lib/api/v3/projects.rb b/lib/api/v3/projects.rb
index 47bfc12035a..b753dbab381 100644
--- a/lib/api/v3/projects.rb
+++ b/lib/api/v3/projects.rb
@@ -234,7 +234,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects, requirements: { id: /[^\/]+/ } do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get a single project' do
           success ::API::V3::Entities::ProjectWithAccess
         end
diff --git a/lib/api/v3/repositories.rb b/lib/api/v3/repositories.rb
index 44584e2eb70..e4d14bc8168 100644
--- a/lib/api/v3/repositories.rb
+++ b/lib/api/v3/repositories.rb
@@ -8,7 +8,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         helpers do
           def handle_project_member_errors(errors)
             if errors[:project_access].any?
diff --git a/lib/api/v3/runners.rb b/lib/api/v3/runners.rb
index 8967141fe3d..1934d6e578c 100644
--- a/lib/api/v3/runners.rb
+++ b/lib/api/v3/runners.rb
@@ -26,7 +26,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         before { authorize_admin_project }
 
         desc "Disable project's runner" do
diff --git a/lib/api/v3/services.rb b/lib/api/v3/services.rb
index d77185ffe5a..3bacaeee032 100644
--- a/lib/api/v3/services.rb
+++ b/lib/api/v3/services.rb
@@ -554,7 +554,10 @@ module API
         ]
       }.freeze
 
-      resource :projects do
+      params do
+        requires :id, type: String, desc: 'The ID of a project'
+      end
+      resource :projects, requirements: { id: %r{[^/]+} } do
         before { authenticate! }
         before { authorize_admin_project }
 
@@ -609,7 +612,7 @@ module API
         params do
           requires :id, type: String, desc: 'The ID of a project'
         end
-        resource :projects do
+        resource :projects, requirements: { id: %r{[^/]+} } do
           desc "Trigger a slash command for #{service_slug}" do
             detail 'Added in GitLab 8.13'
           end
diff --git a/lib/api/v3/subscriptions.rb b/lib/api/v3/subscriptions.rb
index 02a4157c26e..068750ec077 100644
--- a/lib/api/v3/subscriptions.rb
+++ b/lib/api/v3/subscriptions.rb
@@ -14,7 +14,7 @@ module API
         requires :id, type: String, desc: 'The ID of a project'
         requires :subscribable_id, type: String, desc: 'The ID of a resource'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         subscribable_types.each do |type, finder|
           type_singularized = type.singularize
           entity_class = ::API::Entities.const_get(type_singularized.camelcase)
diff --git a/lib/api/v3/tags.rb b/lib/api/v3/tags.rb
index 6913720d9c5..c2541de2f50 100644
--- a/lib/api/v3/tags.rb
+++ b/lib/api/v3/tags.rb
@@ -6,7 +6,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Get a project repository tags' do
           success ::API::Entities::RepoTag
         end
diff --git a/lib/api/v3/triggers.rb b/lib/api/v3/triggers.rb
index 1dfdb6a5956..b46639a2205 100644
--- a/lib/api/v3/triggers.rb
+++ b/lib/api/v3/triggers.rb
@@ -6,7 +6,7 @@ module API
       params do
         requires :id, type: String, desc: 'The ID of a project'
       end
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Trigger a GitLab project build' do
           success ::API::V3::Entities::TriggerRequest
         end
diff --git a/lib/api/v3/variables.rb b/lib/api/v3/variables.rb
index 0f55a14fb28..83972b1e7ce 100644
--- a/lib/api/v3/variables.rb
+++ b/lib/api/v3/variables.rb
@@ -10,7 +10,7 @@ module API
         requires :id, type: String, desc: 'The ID of a project'
       end
 
-      resource :projects do
+      resource :projects, requirements: { id: %r{[^/]+} } do
         desc 'Delete an existing variable from a project' do
           success ::API::Entities::Variable
         end
diff --git a/lib/api/variables.rb b/lib/api/variables.rb
index 77e5d54c225..5acde41551b 100644
--- a/lib/api/variables.rb
+++ b/lib/api/variables.rb
@@ -9,7 +9,7 @@ module API
       requires :id, type: String, desc: 'The ID of a project'
     end
 
-    resource :projects do
+    resource :projects, requirements: { id: %r{[^/]+} } do
       desc 'Get project variables' do
         success Entities::Variable
       end