diff --git a/veza-backend-api/internal/api/router.go b/veza-backend-api/internal/api/router.go
index 42c1a1567..4adc5ed8e 100644
--- a/veza-backend-api/internal/api/router.go
+++ b/veza-backend-api/internal/api/router.go
@@ -595,8 +595,8 @@ func (r *APIRouter) setupUserRoutes(router *gin.RouterGroup) {
 			// BE-API-007: User role assignment routes
 			roleService := services.NewRoleService(r.db.GormDB)
 			roleHandler := handlers.NewRoleHandler(roleService, r.logger)
-			protected.POST("/:userId/roles", roleHandler.AssignRole)           // POST /api/v1/users/:userId/roles
-			protected.DELETE("/:userId/roles/:roleId", roleHandler.RevokeRole) // DELETE /api/v1/users/:userId/roles/:roleId
+			protected.POST("/:id/roles", roleHandler.AssignRole)           // POST /api/v1/users/:id/roles
+			protected.DELETE("/:id/roles/:roleId", roleHandler.RevokeRole) // DELETE /api/v1/users/:id/roles/:roleId
 
 			// BE-API-021: Avatar upload endpoint
 			// BE-API-022: Avatar delete endpoint
@@ -606,8 +606,8 @@ func (r *APIRouter) setupUserRoutes(router *gin.RouterGroup) {
 			}
 			imageService := services.NewImageService(avatarUploadDir)
 			avatarHandler := handlers.NewAvatarHandler(imageService, userService)
-			protected.POST("/:userId/avatar", avatarHandler.UploadAvatar)   // BE-API-021: Upload avatar endpoint
-			protected.DELETE("/:userId/avatar", avatarHandler.DeleteAvatar) // BE-API-022: Delete avatar endpoint
+			protected.POST("/:id/avatar", avatarHandler.UploadAvatar)   // BE-API-021: Upload avatar endpoint
+			protected.DELETE("/:id/avatar", avatarHandler.DeleteAvatar) // BE-API-022: Delete avatar endpoint
 
 			// BE-API-027: User liked tracks endpoint
 			// Initialize TrackLikeService and minimal TrackHandler for user liked tracks