diff --git a/apps/sim/app/api/tools/jsm/selector-requesttypes/route.ts b/apps/sim/app/api/tools/jsm/selector-requesttypes/route.ts
index ed34d5d7bd..6838e61c13 100644
--- a/apps/sim/app/api/tools/jsm/selector-requesttypes/route.ts
+++ b/apps/sim/app/api/tools/jsm/selector-requesttypes/route.ts
@@ -66,7 +66,7 @@ export async function POST(request: Request) {
     }
 
     const baseUrl = getJsmApiBaseUrl(cloudId)
-    const url = `${baseUrl}/servicedesk/${serviceDeskId}/requesttype?limit=100`
+    const url = `${baseUrl}/servicedesk/${serviceDeskIdValidation.sanitized}/requesttype?limit=100`
 
     const response = await fetch(url, {
       method: 'GET',
diff --git a/apps/sim/app/api/tools/sharepoint/lists/route.ts b/apps/sim/app/api/tools/sharepoint/lists/route.ts
index 68399c72cd..df5602b43a 100644
--- a/apps/sim/app/api/tools/sharepoint/lists/route.ts
+++ b/apps/sim/app/api/tools/sharepoint/lists/route.ts
@@ -89,7 +89,7 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ error: 'Failed to obtain valid access token' }, { status: 401 })
     }
 
-    const url = `https://graph.microsoft.com/v1.0/sites/${siteId}/lists?$select=id,displayName,description,webUrl&$expand=list($select=hidden)&$top=100`
+    const url = `https://graph.microsoft.com/v1.0/sites/${encodeURIComponent(siteId)}/lists?$select=id,displayName,description,webUrl&$expand=list($select=hidden)&$top=100`
 
     const response = await fetch(url, {
       headers: {