diff --git a/pages/api/endpoint/getcase_api.js b/pages/api/endpoint/getcase_api.js
index 8a11cd42..6202e4d5 100644
--- a/pages/api/endpoint/getcase_api.js
+++ b/pages/api/endpoint/getcase_api.js
@@ -11,41 +11,52 @@
  */
 
 import axios from "axios";
-import CryptoJS from "crypto-js";
 import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { hashAPIPath } from "../../../actions/core/hash";
+import { respondError, respondSuccess } from "../middleware/apiResponse";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
 export default async function ApiProxy(req, res) {
-    var incidentID = req.query.incidentID;
-    var token = await getToken();
-    var queryUrl =
-        "incidents(" +
-        incidentID +
-        ")?$select=ticketnumber,title,pinswg_appealcasetype";
+    const incidentID = req.query.incidentID;
 
-    //console.log(WEBAPI_URL + queryUrl + hashAPIPath(queryUrl));
+    if (typeof incidentID !== "string" || incidentID.trim().length === 0) {
+        return respondError(res, {
+            status: 400,
+            code: "INCIDENT_ID_REQUIRED",
+            message: "incidentID is required"
+        });
+    }
 
-    return axios
-        .get(
+    try {
+        const token = await getToken();
+        const queryUrl =
+            "incidents(" +
+            incidentID +
+            ")?$select=ticketnumber,title,pinswg_appealcasetype";
+
+        const { data } = await axios.get(
             WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
             azureHeaders(token.access_token)
-        )
-        .then(({ data }) => {
-            var dataStr;
-            _.has(data, "@odata.nextLink") == true &&
-                ((dataStr = JSON.stringify(data["@odata.nextLink"])),
-                (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
-            res.status(200).json(data);
-        })
-        .catch((error) => {
-            consoleLogger(error);
-            res.status(400).json(error);
+        );
+
+        if (_.has(data, "@odata.nextLink") === true) {
+            const dataStr = JSON.stringify(data["@odata.nextLink"]);
+            data["@odata.nextLink"] = dataStr.split("/v8.2/")[1];
+        }
+
+        return respondSuccess(res, data);
+    } catch (error) {
+        consoleLogger(error);
+        return respondError(res, {
+            status: 400,
+            code: "CASE_FETCH_FAILED",
+            message: "Failed to fetch case"
         });
+    }
 }
diff --git a/pages/api/endpoint/getcasebyid_api.js b/pages/api/endpoint/getcasebyid_api.js
index 7f7f0392..03783f2d 100644
--- a/pages/api/endpoint/getcasebyid_api.js
+++ b/pages/api/endpoint/getcasebyid_api.js
@@ -11,38 +11,49 @@
  */
 
 import axios from "axios";
-import CryptoJS from "crypto-js";
 import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { hashAPIPath } from "../../../actions/core/hash";
+import { respondError, respondSuccess } from "../middleware/apiResponse";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
 export default async function ApiProxy(req, res) {
-    var incidentID = req.query.incidentID;
-    var token = await getToken();
-    var queryUrl = "incidents(" + incidentID + ")";
+    const incidentID = req.query.incidentID;
 
-    //console.log(WEBAPI_URL + queryUrl + hashAPIPath(queryUrl));
+    if (typeof incidentID !== "string" || incidentID.trim().length === 0) {
+        return respondError(res, {
+            status: 400,
+            code: "INCIDENT_ID_REQUIRED",
+            message: "incidentID is required"
+        });
+    }
 
-    return axios
-        .get(
+    try {
+        const token = await getToken();
+        const queryUrl = "incidents(" + incidentID + ")";
+
+        const { data } = await axios.get(
             WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
             azureHeaders(token.access_token)
-        )
-        .then(({ data }) => {
-            var dataStr;
-            _.has(data, "@odata.nextLink") == true &&
-                ((dataStr = JSON.stringify(data["@odata.nextLink"])),
-                (data["@odata.nextLink"] = dataStr.split("/v8.2/")[1]));
-            res.status(200).json([data]);
-        })
-        .catch((error) => {
-            consoleLogger(error);
-            res.status(400).json(error);
+        );
+
+        if (_.has(data, "@odata.nextLink") === true) {
+            const dataStr = JSON.stringify(data["@odata.nextLink"]);
+            data["@odata.nextLink"] = dataStr.split("/v8.2/")[1];
+        }
+
+        return respondSuccess(res, [data]);
+    } catch (error) {
+        consoleLogger(error);
+        return respondError(res, {
+            status: 400,
+            code: "CASE_BY_ID_FETCH_FAILED",
+            message: "Failed to fetch case by id"
         });
+    }
 }
diff --git a/pages/api/endpoint/getincidentbyid_api.js b/pages/api/endpoint/getincidentbyid_api.js
index 15b135b2..591d972c 100644
--- a/pages/api/endpoint/getincidentbyid_api.js
+++ b/pages/api/endpoint/getincidentbyid_api.js
@@ -16,53 +16,49 @@
  */
 
 import axios from "axios";
-import CryptoJS from "crypto-js";
-import _ from "lodash";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { hashAPIPath } from "../../../actions/core/hash";
+import { respondError, respondSuccess } from "../middleware/apiResponse";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
 export default async function ApiProxy(req, res) {
-    var searchString = req.query.searchString;
-    var token = await getToken();
+    let searchString = req.query.searchString;
 
-    searchString = searchString.replace(/\'/g, "''");
+    if (typeof searchString !== "string" || searchString.trim().length === 0) {
+        return respondError(res, {
+            status: 400,
+            code: "SEARCH_STRING_REQUIRED",
+            message: "searchString is required"
+        });
+    }
 
-    var queryUrl =
-        "incidents?$select=pinswg_environmentalstatementlocation,pinswg_publishtoweb,modifiedon,description,numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value,pinswg_lpareference,pinswg_appellantagent,pinswg_appellantfirstname,pinswg_appellantlastname&$expand=primarycontactid($select=fullname)&$filter=incidentid eq " +
-        searchString +
-        " and pinswg_appealcasetype ne null &$orderby=createdon desc&$count=true";
+    try {
+        const token = await getToken();
 
-    var apiResponse = _.isEmpty(req.query)
-        ? res.status(400).json()
-        : searchString.length > 0
-          ? axios
-                .get(
-                    WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                    azureHeaders(token.access_token)
-                )
-                .then(({ data }) => {
-                    //console.log(
-                    ("\n==========================================\n",
-                        //       "basic search incident: " + queryUrl,
-                        //       "\n\n",
-                        //       "data: " + JSON.stringify(data),
-                        //       "\n\n",
-                        "publihs:" + JSON.stringify(data.value[0]),
-                        "\n==========================================\n");
-                    //);
-                    return res.status(200).json(data);
-                })
-                .catch((error) => {
-                    consoleLogger(error);
-                    res.status(400).json(error);
-                })
-          : res.status(400).json();
+        searchString = searchString.replace(/\'/g, "''");
 
-    return apiResponse;
+        const queryUrl =
+            "incidents?$select=pinswg_environmentalstatementlocation,pinswg_publishtoweb,modifiedon,description,numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value,pinswg_lpareference,pinswg_appellantagent,pinswg_appellantfirstname,pinswg_appellantlastname&$expand=primarycontactid($select=fullname)&$filter=incidentid eq " +
+            searchString +
+            " and pinswg_appealcasetype ne null &$orderby=createdon desc&$count=true";
+
+        const { data } = await axios.get(
+            WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+            azureHeaders(token.access_token)
+        );
+
+        return respondSuccess(res, data);
+    } catch (error) {
+        consoleLogger(error);
+        return respondError(res, {
+            status: 400,
+            code: "INCIDENT_BY_ID_FETCH_FAILED",
+            message: "Failed to fetch incident by id"
+        });
+    }
 }
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 1cb9ea97..736421e7 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -2147,6 +2147,142 @@ test("getmylpacases catch path returns MY_LPA_CASES_FETCH_FAILED", async () => {
     );
 });
 
+test("getcase returns INCIDENT_ID_REQUIRED when incidentID missing", async () => {
+    const mod = loadModule("pages/api/endpoint/getcase_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: { get: async () => ({ data: { ticketnumber: "CAS-1" } }) },
+        consoleLogger: () => {},
+        _: { has: () => false }
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INCIDENT_ID_REQUIRED");
+});
+
+test("getcase catch path returns CASE_FETCH_FAILED", async () => {
+    const mod = loadModule("pages/api/endpoint/getcase_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: {
+            get: async () => {
+                throw new Error("relay failed");
+            }
+        },
+        consoleLogger: () => {},
+        _: { has: () => false }
+    });
+
+    const req = { query: { incidentID: "i1" } };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "CASE_FETCH_FAILED");
+});
+
+test("getcasebyid returns INCIDENT_ID_REQUIRED when incidentID missing", async () => {
+    const mod = loadModule("pages/api/endpoint/getcasebyid_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: { get: async () => ({ data: { ticketnumber: "CAS-1" } }) },
+        consoleLogger: () => {},
+        _: { has: () => false }
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INCIDENT_ID_REQUIRED");
+});
+
+test("getcasebyid catch path returns CASE_BY_ID_FETCH_FAILED", async () => {
+    const mod = loadModule("pages/api/endpoint/getcasebyid_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: {
+            get: async () => {
+                throw new Error("relay failed");
+            }
+        },
+        consoleLogger: () => {},
+        _: { has: () => false }
+    });
+
+    const req = { query: { incidentID: "i1" } };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "CASE_BY_ID_FETCH_FAILED"
+    );
+});
+
+test("getincidentbyid returns SEARCH_STRING_REQUIRED when searchString missing", async () => {
+    const mod = loadModule("pages/api/endpoint/getincidentbyid_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: { get: async () => ({ data: { value: [] } }) },
+        consoleLogger: () => {}
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "SEARCH_STRING_REQUIRED");
+});
+
+test("getincidentbyid catch path returns INCIDENT_BY_ID_FETCH_FAILED", async () => {
+    const mod = loadModule("pages/api/endpoint/getincidentbyid_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=expected",
+        azureHeaders: () => ({}),
+        axios: {
+            get: async () => {
+                throw new Error("relay failed");
+            }
+        },
+        consoleLogger: () => {}
+    });
+
+    const req = { query: { searchString: "incident-guid" } };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "INCIDENT_BY_ID_FETCH_FAILED"
+    );
+});
+
 const run = async () => {
     let passed = 0;
     for (const currentTest of tests) {