2 files changed, 3 insertions, 1 deletions
diff --git a/synapse/handlers/identity.py b/synapse/handlers/identity.py
index 5b610990b6..dc77b6786f 100644
--- a/synapse/handlers/identity.py
+++ b/synapse/handlers/identity.py
@@ -403,7 +403,7 @@ class IdentityHandler(BaseHandler):
         target = self.rewrite_identity_server_urls.get(id_server, id_server)
 
         try:
-            data = yield self.http_client.post_json(
+            data = yield self.http_client.post_json_get_json(
                 "https://%s/_matrix/identity/api/v1/bulk_lookup" % (target,),
                 {
                     "threepids": threepids,
diff --git a/synapse/rest/client/v2_alpha/account.py b/synapse/rest/client/v2_alpha/account.py
index 154700d7d1..f1037ce115 100644
--- a/synapse/rest/client/v2_alpha/account.py
+++ b/synapse/rest/client/v2_alpha/account.py
@@ -531,6 +531,8 @@ class ThreepidBulkLookupRestServlet(RestServlet):
 
         body = parse_json_object_from_request(request)
 
+        assert_params_in_dict(body, ["threepids", "id_server"])
+
         # Proxy the request to the identity server. lookup_3pid handles checking
         # if the lookup is allowed so we don't need to do it here.
         ret = yield self.identity_handler.bulk_lookup_3pid(