diff --git a/server/routers/user/getOrgUser.ts b/server/routers/user/getOrgUser.ts
index 34732b8d8..974f77fc6 100644
--- a/server/routers/user/getOrgUser.ts
+++ b/server/routers/user/getOrgUser.ts
@@ -117,7 +117,9 @@ export async function getOrgUser(
 
         const { orgId, userId } = parsedParams.data;
 
-        if (!req.userOrg) {
+        // API keys never have a userOrg; their org access and action are
+        // already checked by verifyApiKeyOrgAccess / verifyApiKeyHasAction
+        if (req.user && !req.userOrg) {
             return next(
                 createHttpError(
                     HttpCode.FORBIDDEN,
@@ -150,7 +152,7 @@ export async function getOrgUser(
             );
         }
 
-        if (req.user && user.userId !== req.userOrg.userId) {
+        if (req.user && user.userId !== req.user.userId) {
             const hasPermission = await checkUserActionPermission(
                 ActionsEnum.getOrgUser,
                 req