nit: this feels like a 201 to me

I'm not that familiar with permissions system but this part smells to me a bit.
Why permission check is a custom for loop in this endpoint implementation? Shouldn't it be some common function.

ExtractUserParam uses different logic for returning codes:

        user, err := db.GetUserByID(ctx, apiKey.UserID)
		if httpapi.Is404Error(err) {
			httpapi.ResourceNotFound(rw)
			return database.User{}, false
		}
		if err != nil {
			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
				Message: "Internal error fetching user.",
				Detail:  err.Error(),
			})
			return database.User{}, false
		}

endpoint gets user ids as input, user name in response would not be helpful to understand which ID is causing issues.

This is more of a nit but I'm also not sure if this case should return error. If user is already there it could just be skipped. No error would make it easier to add whole group of users without needing to filter / know if some users are already in org.
I think it makes sense in single user case but not necessarily in batch request.

This slice seems redundant if usernames won't be returned in error message.

I think different status should be returned depending on error, probably mostly internal server error instead of StatusBadRequest?

single user endpoint also checks:

	if len(resp) == 0 {
		httpapi.InternalServerError(rw, xerrors.Errorf("marshal member"))
		return
	}

Does it need to be deprecated? It has a bit different input, single-member endpoint accepts ID, username, or "me".

I would prefer to deprecate it, else we have two seperate ways to input organization members to the database forevermore 🙂

Would it be possible to single batch user lookup?

How about INSERT ... ON CONFLICT DO NOTHING

This would also help with race condition where user is added to organization between existingRows are read and transaction starts.

nit: AI says that GetUsersByIDs also returns deleted users.

Apparently this is already present in postOrganizationMember endpoint but I think it would make sense to return error in such case (adding deleted user to org)?
Something like:

var deleted []uuid.UUID
  for _, user := range users {
  	if user.Deleted {
  		deleted = append(deleted, user.ID)
  	}
  }

  if len(deleted) > 0 {
  	httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
  		Message: fmt.Sprintf("Deleted users cannot be added to an organization: %v", deleted),
  	})
  	return
  }

add test please