diff --git a/api/controllers/web/passport.py b/api/controllers/web/passport.py
index 3e4a7960984..46482b9c53e 100644
--- a/api/controllers/web/passport.py
+++ b/api/controllers/web/passport.py
@@ -5,6 +5,7 @@ from werkzeug.exceptions import NotFound, Unauthorized
 
 from constants import HEADER_NAME_APP_CODE
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
+from controllers.console.wraps import model_validate
 from controllers.web import web_ns
 from controllers.web.error import WebAppAuthRequiredError
 from extensions.ext_application_services import application_services
@@ -48,12 +49,12 @@ class PassportResource(Resource):
         }
     )
     @web_ns.response(200, "Passport retrieved successfully", web_ns.models[PassportAccessTokenResponse.__name__])
-    def get(self):
+    @model_validate(PassportQuery)
+    def get(self, query: PassportQuery):
         app_code = request.headers.get(HEADER_NAME_APP_CODE)
         if app_code is None:
             raise Unauthorized("X-App-Code header is missing.")
 
-        query = PassportQuery.model_validate(request.args.to_dict(flat=True))
         passport_request = WebPassportRequest(
             app_code=app_code,
             user_session_id=query.user_id,
diff --git a/api/tests/unit_tests/controllers/web/test_web_passport.py b/api/tests/unit_tests/controllers/web/test_web_passport.py
index 9ac0b731a3a..fd6cd80d062 100644
--- a/api/tests/unit_tests/controllers/web/test_web_passport.py
+++ b/api/tests/unit_tests/controllers/web/test_web_passport.py
@@ -1,6 +1,5 @@
 """Unit tests for the thin web-passport Flask adapter."""
 
-from inspect import unwrap
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
@@ -31,7 +30,7 @@ def test_passport_resource_parses_input_and_serializes_result(app: Flask) -> Non
         patch("controllers.web.passport.application_services", return_value=services),
         patch("controllers.web.passport.extract_webapp_access_token", return_value="login-token"),
     ):
-        result = unwrap(PassportResource.get)(PassportResource())
+        result = PassportResource().get()
 
     assert result == {"access_token": "issued-token"}
     service.issue.assert_called_once_with(
@@ -41,7 +40,7 @@ def test_passport_resource_parses_input_and_serializes_result(app: Flask) -> Non
 
 def test_passport_resource_requires_app_code(app: Flask) -> None:
     with app.test_request_context("/passport"), pytest.raises(Unauthorized, match="X-App-Code"):
-        unwrap(PassportResource.get)(PassportResource())
+        PassportResource().get()
 
 
 @pytest.mark.parametrize(
@@ -66,4 +65,4 @@ def test_passport_resource_translates_application_errors(
         patch("controllers.web.passport.application_services", return_value=services),
         pytest.raises(http_error),
     ):
-        unwrap(PassportResource.get)(PassportResource())
+        PassportResource().get()