{"record":{"id":"1d5b16427c4b649c","repo":"calcom/cal.diy","slug":"booking-with-uid-bookinguid-does-not-belong-to","errorCode":null,"errorMessage":"Booking with uid ${bookingUid} does not belong to user","messagePattern":"Booking with uid (.+?) does not belong to user","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/api/v2/src/platform/bookings/2024-08-13/services/booking-references.service.ts","lineNumber":27,"sourceCode":"  constructor(\n    private readonly bookingsRepository: BookingsRepository_2024_08_13,\n    private readonly bookingReferencesRepository: BookingReferencesRepository_2024_08_13,\n    private readonly outputBookingReferencesService: OutputBookingReferencesService_2024_08_13\n  ) {}\n\n  async getBookingReferences(\n    bookingUid: string,\n    userId: number,\n    filter?: BookingReferencesFilterInput_2024_08_13\n  ) {\n    const booking = await this.bookingsRepository.getByUidWithUser(bookingUid);\n\n    if (!booking) {\n      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);\n    }\n\n    if (booking.user?.id !== userId) {\n      throw new BadRequestException(`Booking with uid ${bookingUid} does not belong to user`);\n    }\n\n    const bookingReferences = await this.bookingReferencesRepository.getBookingReferences(booking.id, filter);\n\n    return this.outputBookingReferencesService.getOutputBookingReferences(bookingReferences);\n  }\n\n  async getOrgBookingReferences(bookingUid: string, filter?: BookingReferencesFilterInput_2024_08_13) {\n    const booking = await this.bookingsRepository.getByUidWithUser(bookingUid);\n\n    if (!booking) {\n      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);\n    }\n\n    const bookingReferences = await this.bookingReferencesRepository.getBookingReferences(booking.id, filter);\n\n    return this.outputBookingReferencesService.getOutputBookingReferences(bookingReferences);\n  }","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/platform/bookings/2024-08-13/services/booking-references.service.ts#L9-L45","documentation":"Thrown in getBookingReferences when the resolved booking's user.id does not equal the authenticated userId. Notably this is a BadRequestException (HTTP 400), not a 403 — the endpoint treats ownership as an input precondition. The booking exists but does not belong to the caller.","triggerScenarios":"GET booking references using an API key/access token whose userId differs from the booking's owner. The booking resolves (so 272 didn't fire) but booking.user?.id !== userId.","commonSituations":"Sharing a booking UID across users; using the wrong user's API key; booking whose owner was changed; user expected org-level access but used the per-user endpoint.","solutions":["Use an API key belonging to the booking's owner user.","For cross-user/org access, use the org-level references endpoint (getOrgBookingReferences) instead of the per-user one.","Confirm the authenticated user id matches booking.user.id before calling."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm ownership before calling the per-user references endpoint.\nconst me = await api.get('/v2/me');\nconst booking = await api.get(`/v2/bookings/${uid}`);\nif (booking.user?.id !== me.id) throw new Error(`Booking ${uid} does not belong to user ${me.id}; use the org endpoint`);","typeGuard":null,"tryCatchPattern":"try {\n  await api.get(`/v2/bookings/${uid}/references`);\n} catch (err) {\n  if (err.status === 400 && /does not belong to user/.test(err.message)) {\n    // switch to the org references endpoint or the booking owner's API key\n  }\n  throw err;\n}","preventionTips":["Use the booking owner's API key for the per-user references endpoint.","For cross-user/org scenarios, call the org-level references endpoint.","Check booking.user.id === authenticated userId before calling."],"tags":["authorization","booking","references","bad-request"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}