使用Azure DevOps REST API移除团队用户时请求无效错误排查

我尝试用PowerShell移除Azure DevOps项目团队中的用户，代码如下：

$AzureDevOpsPAT = "XXXXXXXXXXXXXXXXX"
$groupid = "vssgp.UyXXXXXXXXXXXXXXUxMjkzxx"
$memberid = "tester.deer@dmain.com"
$AzureDevOpsAuthenicationHeader = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$($AzureDevOpsPAT)"))

$saasheaders = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$saasheaders.Add("Authorization", "Basic $AzureDevOpsAuthenicationHeader")
$saasheaders.Add("Accept", "*/*")
$saasheaders.Add("Cache-Control", "no-cache")
$saasheaders.Add("Accept-Encoding", "gzip, deflate")
$saasheaders.Add("Content-Type", "application/json")

$result = Invoke-RestMethod "https://vsaex.dev.azure.com/mycollectionname/_apis/GroupEntitlements/$groupid/members/$memberid`?api-version=5.1-preview.1" -Method 'DELETE' -Headers $saasheaders 
Write-Host "value is $result"

执行后收到错误：

Invoke-RestMethod : {"count":1,"value":{"Message":"The request is invalid."}}
+ ... result = Invoke-RestMethod "https://vsaex.dev.azure.com/myorganization/_apis ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

错误原因及修正方案 #

1. MemberID参数错误（核心问题） #

代码中使用的memberid是用户邮箱，但该API要求的memberId必须是用户的唯一标识符（格式通常为vssuser.xxxxxx或GUID），而非邮箱地址。

要获取用户的正确ID，可调用用户列表API：

$orgName = "你的组织名"
$userEmail = "tester.deer@dmain.com"
$userInfo = Invoke-RestMethod "https://vsaex.dev.azure.com/$orgName/_apis/UserEntitlements?api-version=5.1-preview.1" -Headers $saasheaders
$targetUserId = ($userInfo.value | Where-Object { $_.userPrincipalName -eq $userEmail }).id

获取到$targetUserId后，替换代码中的$memberid即可。

2. API路径中的组织名错误 #

API URL里的mycollectionname需要替换为你的Azure DevOps组织名称，而非集合名称。正确的URL格式应为：

https://vsaex.dev.azure.com/{组织名}/_apis/GroupEntitlements/$groupid/members/$memberid?api-version=5.1-preview.1

3. 多余的请求头 #

DELETE请求不需要Content-Type头（无请求体），移除$saasheaders.Add("Content-Type", "application/json")这一行，避免不必要的格式干扰。

修正后的完整代码 #

$AzureDevOpsPAT = "XXXXXXXXXXXXXXXXX"
$orgName = "你的组织名"
$groupid = "vssgp.UyXXXXXXXXXXXXXXUxMjkzxx"
$userEmail = "tester.deer@dmain.com"

# 生成认证头
$AzureDevOpsAuthenicationHeader = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$($AzureDevOpsPAT)"))
$saasheaders = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$saasheaders.Add("Authorization", "Basic $AzureDevOpsAuthenicationHeader")
$saasheaders.Add("Accept", "*/*")
$saasheaders.Add("Cache-Control", "no-cache")
$saasheaders.Add("Accept-Encoding", "gzip, deflate")

# 获取用户ID
$userInfo = Invoke-RestMethod "https://vsaex.dev.azure.com/$orgName/_apis/UserEntitlements?api-version=5.1-preview.1" -Headers $saasheaders
$memberid = ($userInfo.value | Where-Object { $_.userPrincipalName -eq $userEmail }).id

# 执行移除操作
$result = Invoke-RestMethod "https://vsaex.dev.azure.com/$orgName/_apis/GroupEntitlements/$groupid/members/$memberid?api-version=5.1-preview.1" -Method 'DELETE' -Headers $saasheaders 
Write-Host "用户已成功移除，返回结果：$result"

内容的提问来源于stack exchange，提问作者Joe_12345