{"record":{"id":"0adf3eb557affdc5","repo":"calcom/cal.diy","slug":"trying-to-reschedule-an-event-type-which-requires","errorCode":null,"errorMessage":"Trying to reschedule an event-type which requires authentication but provided invalid rescheduleUid.","messagePattern":"Trying to reschedule an event-type which requires authentication but provided invalid rescheduleUid\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/api/v2/src/platform/bookings/2024-04-15/controllers/bookings.controller.ts","lineNumber":459,"sourceCode":"  private async checkBookingRequiresAuthentication(\n    req: Request,\n    eventTypeId: number,\n    rescheduleUid?: string\n  ): Promise<void> {\n    const eventType = await this.eventTypeRepository.findByIdIncludeHostsAndTeamMembers({\n      id: eventTypeId,\n    });\n\n    if (!eventType?.bookingRequiresAuthentication) {\n      return;\n    }\n\n    if (rescheduleUid) {\n      const isValidRescheduleBooking = await this.isValidRescheduleBooking(rescheduleUid, eventTypeId);\n      if (isValidRescheduleBooking) {\n        return;\n      } else {\n        throw new BadRequestException(\n          \"Trying to reschedule an event-type which requires authentication but provided invalid rescheduleUid.\"\n        );\n      }\n    }\n\n    const owner = await this.getOwner(req);\n    const userId = owner?.id;\n\n    if (!userId) {\n      throw new UnauthorizedException(\n        \"This event type requires authentication. Please provide valid credentials.\"\n      );\n    }\n\n    const isEventTypeOwner = eventType.userId === userId;\n    const isHost = eventType.hosts.some((host) => host.userId === userId);\n    const isTeamAdminOrOwner = eventType.team?.members.some((member) => member.userId === userId) ?? false;\n","sourceCodeStart":441,"sourceCodeEnd":477,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/platform/bookings/2024-04-15/controllers/bookings.controller.ts#L441-L477","documentation":"A 400 BadRequest thrown by checkBookingRequiresAuthentication when the target event type has bookingRequiresAuthentication enabled, the caller provided a rescheduleUid, but isValidRescheduleBooking returned false. isValidRescheduleBooking checks three things: the booking must exist, its status must be ACCEPTED or PENDING, and its eventTypeId must match the requested eventTypeId.","triggerScenarios":"POST /v2/bookings or POST /v2/bookings/recurring with a rescheduleUid and an eventTypeId where: (a) the rescheduleUid doesn't correspond to any booking, (b) the referenced booking is CANCELLED/REJECTED, or (c) the rescheduleUid belongs to a booking for a different event type than the one in the request body.","commonSituations":"Client sends a stale or copy-pasted rescheduleUid from a different event type. The original booking was already cancelled and the client is retrying. The eventTypeId in the body was changed but the rescheduleUid wasn't updated. Mismatched eventTypeId across recurring series members.","solutions":["Verify the rescheduleUid corresponds to a valid, non-cancelled booking by calling GET /v2/bookings/:bookingUid first.","Ensure the eventTypeId in the request body matches the event type of the original booking referenced by rescheduleUid.","If the original booking was cancelled, create a new booking instead of rescheduling.","Check that the rescheduleUid hasn't already been used for a successful reschedule (which may have changed its status)."],"exampleFix":"// before — client sends mismatched eventTypeId\nPOST /v2/bookings { eventTypeId: 10, rescheduleUid: \"abc-123\" }\n\n// after — fetch the original booking first, match its eventTypeId\nconst original = await fetch(`/v2/bookings/${rescheduleUid}`);\nPOST /v2/bookings { eventTypeId: original.eventTypeId, rescheduleUid: \"abc-123\" }","handlingStrategy":"validation","validationCode":"// Before calling POST /v2/bookings with a rescheduleUid, validate it\nasync function isValidRescheduleUid(rescheduleUid, eventTypeId) {\n  const res = await fetch(`/v2/bookings/${rescheduleUid}`);\n  if (!res.ok) return false;\n  const { data } = await res.json();\n  // Must exist, be ACCEPTED/PENDING, and match the eventTypeId\n  return (\n    data &&\n    ['ACCEPTED', 'PENDING'].includes(data.status) &&\n    data.eventTypeId === eventTypeId\n  );\n}\n\nif (rescheduleUid && !(await isValidRescheduleUid(rescheduleUid, eventTypeId))) {\n  throw new Error('Invalid rescheduleUid — create a new booking instead');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.createBooking({ eventTypeId, rescheduleUid, ... });\n} catch (err) {\n  if (err.statusCode === 400 && err.message.includes('invalid rescheduleUid')) {\n    // Discard the stale rescheduleUid and create a fresh booking\n    await api.createBooking({ eventTypeId, ... }); // without rescheduleUid\n  } else {\n    throw err;\n  }\n}","preventionTips":["Always fetch the original booking by UID before rescheduling to verify it exists and matches the event type.","Discard rescheduleUids from cancelled bookings — they cannot be rescheduled.","Store the eventTypeId alongside the bookingUid in your system to avoid mismatches.","Test reschedule flows against non-authenticated event types first to isolate auth-specific issues."],"tags":["validation","reschedule","authentication","event-type","booking"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}