Retrieve a city list for a country and state
Utilize the query object, this type of querying is more suitable there than as params.
Use object destructuring.
Dry your code, see how we're mapping over [countryId, stateId] to check the validity of the input. Ideally, you would have been using a module like Joi for that.
Maintain a happy path and break out of the function early when erroring.
Use async/await instead of .then().
Return a 400 when the input is invalid.
User proper camelCase (in both the DB and the backend).
Check the array length instead of checking the existence of the first element. So if (arr.length) not if (arr[0]). The reason for that is at some cases the first element of the array could be 'falsy' (such as '' and 0) which can be valid sometimes.
When erroring, return an error field, not a msg one.
Study javascript's array methods such as map, reduce, filter, and every. They will save your life more often than you thought.


router.get("/citylist", async (req, res) =&gt; {
  try {

    const { countryid, stateId } = req.query

    const validInput = [countryid, stateid].map(mongoose.Types.ObjectId.isValid).every(Boolean)
    if (!validInput) return res.status(400).json({ error: "Country or State Id is not valid" })

    const cities = await CityModel.find({ countryId, stateId })
    if (!cities || cities.length) return res.status(404).json({ error: "City not found" })

    res.json(cities);

  } catch (error) {
    res.status(500).json({ error })
  }
});