diff --git a/src/Api/KeyManagement/Controllers/UsersController.cs b/src/Api/KeyManagement/Controllers/UsersController.cs
index e8caeb7eb3..5972d62b8d 100644
--- a/src/Api/KeyManagement/Controllers/UsersController.cs
+++ b/src/Api/KeyManagement/Controllers/UsersController.cs
@@ -6,6 +6,8 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using UserKeyResponseModel = Bit.Api.Models.Response.UserKeyResponseModel;
 
+#nullable enable
+
 namespace Bit.Api.KeyManagement.Controllers;
 
 [Route("users")]
@@ -22,11 +24,10 @@ public class UsersController : Controller
     }
 
     [HttpGet("{id}/public-key")]
-    public async Task<UserKeyResponseModel> GetPublicKeyAsync(string id)
+    public async Task<UserKeyResponseModel> GetPublicKeyAsync([FromRoute] Guid id)
     {
-        var guidId = new Guid(id);
-        var key = await _userRepository.GetPublicKeyAsync(guidId) ?? throw new NotFoundException();
-        return new UserKeyResponseModel(guidId, key);
+        var key = await _userRepository.GetPublicKeyAsync(id) ?? throw new NotFoundException();
+        return new UserKeyResponseModel(id, key);
     }
 
     [HttpGet("{id}/keys")]
diff --git a/src/Api/KeyManagement/Models/Response/PrivateKeysResponseModel.cs b/src/Api/KeyManagement/Models/Response/PrivateKeysResponseModel.cs
index 9445b1ba2f..10465931db 100644
--- a/src/Api/KeyManagement/Models/Response/PrivateKeysResponseModel.cs
+++ b/src/Api/KeyManagement/Models/Response/PrivateKeysResponseModel.cs
@@ -14,6 +14,10 @@ namespace Bit.Api.KeyManagement.Models.Response;
 /// </summary>
 public class PrivateKeysResponseModel : ResponseModel
 {
+    // Not all accounts have signature keys, but all accounts have public encryption keys.
+    public SignatureKeyPairResponseModel? SignatureKeyPair { get; set; }
+    public required PublicKeyEncryptionKeyPairModel PublicKeyEncryptionKeyPair { get; set; }
+
     [System.Diagnostics.CodeAnalysis.SetsRequiredMembersAttribute]
     public PrivateKeysResponseModel(UserAccountKeysData accountKeys) : base("privateKeys")
     {
@@ -33,9 +37,4 @@ public class PrivateKeysResponseModel : ResponseModel
         SignatureKeyPair = signatureKeyPair;
         PublicKeyEncryptionKeyPair = publicKeyEncryptionKeyPair ?? throw new ArgumentNullException(nameof(publicKeyEncryptionKeyPair));
     }
-
-    // Not all accounts have signature keys, but all accounts have public encryption keys.
-    public SignatureKeyPairResponseModel? SignatureKeyPair { get; set; }
-    public required PublicKeyEncryptionKeyPairModel PublicKeyEncryptionKeyPair { get; set; }
-
 }
diff --git a/src/Api/KeyManagement/Models/Response/PublicKeysResponseModel.cs b/src/Api/KeyManagement/Models/Response/PublicKeysResponseModel.cs
index 8c2bde58aa..cc527ccd8d 100644
--- a/src/Api/KeyManagement/Models/Response/PublicKeysResponseModel.cs
+++ b/src/Api/KeyManagement/Models/Response/PublicKeysResponseModel.cs
@@ -15,8 +15,8 @@ public class PublicKeysResponseModel : ResponseModel
     public PublicKeysResponseModel(UserAccountKeysData accountKeys)
         : base("publicKeys")
     {
-        PublicKey = accountKeys.PublicKeyEncryptionKeyPairData.PublicKey;
         ArgumentNullException.ThrowIfNull(accountKeys);
+        PublicKey = accountKeys.PublicKeyEncryptionKeyPairData.PublicKey;
 
         if (accountKeys.SignatureKeyPairData != null)
         {