Raise a validation error when attempting to set ordering with cursor pagination

netbox/netbox/api/pagination.py

@@ -53,6 +53,10 @@ class NetBoxPagination(LimitOffsetPagination):
                 raise ValidationError(
                     f"'{self.start_query_param}' and '{self.offset_query_param}' are mutually exclusive."
                 )
+            if 'ordering' in request.query_params:
+                raise ValidationError(
+                    f"'{self.start_query_param}' and 'ordering' are mutually exclusive."
+                )
 
             self.count = None
             self.offset = 0

netbox/netbox/tests/test_api.py

@@ -104,3 +104,10 @@ class OptionalLimitOffsetPaginationTest(TestCase):
         request = self._make_drf_request(query_params={'start': '1', 'offset': '10'})
         with self.assertRaises(ValidationError):
             self.paginator.paginate_queryset(queryset, request)
+
+    def test_cursor_and_ordering_conflict_raises_validation_error(self):
+        """paginate_queryset() raises ValidationError when both start and ordering are specified"""
+        queryset = Token.objects.all().order_by('created')
+        request = self._make_drf_request(query_params={'start': '1', 'ordering': 'created'})
+        with self.assertRaises(ValidationError):
+            self.paginator.paginate_queryset(queryset, request)

netbox/utilities/tests/test_api.py

@@ -231,6 +231,12 @@ class APIPaginationTestCase(APITestCase):
             response = self.client.get(f'{self.url}?start=1&offset=10', format='json', **self.header)
         self.assertHttpStatus(response, status.HTTP_400_BAD_REQUEST)
 
+    def test_cursor_and_ordering_conflict(self):
+        """Specifying both start and ordering returns a 400 error."""
+        with disable_warnings('django.request'):
+            response = self.client.get(f'{self.url}?start=1&ordering=name', format='json', **self.header)
+        self.assertHttpStatus(response, status.HTTP_400_BAD_REQUEST)
+
     def test_cursor_negative_start(self):
         """Negative start value returns a 400 error."""
         with disable_warnings('django.request'):