diff --git a/api/src/exam-environment/routes/exam-environment.test.ts b/api/src/exam-environment/routes/exam-environment.test.ts
index ca4e3f00374..9c73f3e22f5 100644
--- a/api/src/exam-environment/routes/exam-environment.test.ts
+++ b/api/src/exam-environment/routes/exam-environment.test.ts
@@ -1304,6 +1304,16 @@ describe('/exam-environment/', () => {
         );
         expect(res3.status).toBe(200);
       });
+
+      it('should return 400 if neither challengeId or examId are provided', async () => {
+        const res = await superGet(`/exam-environment/exam-challenge`);
+        expect(res).toMatchObject({
+          status: 400,
+          body: {
+            code: 'FCC_ERR_EXAM_ENVIRONMENT'
+          }
+        });
+      });
     });
   });
 });
diff --git a/api/src/exam-environment/routes/exam-environment.ts b/api/src/exam-environment/routes/exam-environment.ts
index 4346ca412ee..929b14f8361 100644
--- a/api/src/exam-environment/routes/exam-environment.ts
+++ b/api/src/exam-environment/routes/exam-environment.ts
@@ -1010,6 +1010,16 @@ export async function getExamChallenge(
 
   logger.info({ challengeId, examId });
 
+  if (!challengeId && !examId) {
+    logger.warn('No challenge or exam id provided.');
+    void reply.code(400);
+    return reply.send(
+      ERRORS.FCC_ERR_EXAM_ENVIRONMENT(
+        'Must provide either a challengeId or examId.'
+      )
+    );
+  }
+
   const maybeData = await mapErr(
     this.prisma.examEnvironmentChallenge.findMany({
       where: {