{"record":{"id":"3ce5846d953fb551","repo":"calcom/cal.diy","slug":"you-are-not-authorized-to-book-this-event-type-yo","errorCode":null,"errorMessage":"You are not authorized to book this event type. You must be the event type owner, a host, a team admin/owner, or an organization admin/owner.","messagePattern":"You are not authorized to book this event type\\. You must be the event type owner, a host, a team admin/owner, or an organization admin/owner\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"apps/api/v2/src/platform/bookings/2024-04-15/controllers/bookings.controller.ts","lineNumber":492,"sourceCode":"    const isEventTypeOwner = eventType.userId === userId;\n    const isHost = eventType.hosts.some((host) => host.userId === userId);\n    const isTeamAdminOrOwner = eventType.team?.members.some((member) => member.userId === userId) ?? false;\n\n    let isOrgAdminOrOwner = false;\n    if (eventType.team?.parentId) {\n      const orgTeam = await this.teamRepository.getTeamByIdIfUserIsAdmin({\n        userId,\n        teamId: eventType.team.parentId,\n      });\n      isOrgAdminOrOwner = !!orgTeam;\n    } else if (eventType.team?.isOrganization) {\n      isOrgAdminOrOwner = isTeamAdminOrOwner;\n    }\n\n    const isAuthorized = isEventTypeOwner || isHost || isTeamAdminOrOwner || isOrgAdminOrOwner;\n\n    if (!isAuthorized) {\n      throw new ForbiddenException(\n        \"You are not authorized to book this event type. You must be the event type owner, a host, a team admin/owner, or an organization admin/owner.\"\n      );\n    }\n  }\n\n  private async getOAuthClientsParams(clientId: string, isEmbed = false): Promise<OAuthRequestParams> {\n    const res = { ...DEFAULT_PLATFORM_PARAMS };\n\n    if (isEmbed) {\n      // embed should ignore oauth client settings and enable emails by default\n      return { ...res, arePlatformEmailsEnabled: true, areCalendarEventsEnabled: true };\n    }\n\n    try {\n      const client = await this.oAuthClientRepository.getOAuthClient(clientId);\n      // fetch oAuthClient from db and use data stored in db to set these values\n      if (client) {\n        res.platformClientId = clientId;","sourceCodeStart":474,"sourceCodeEnd":510,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/platform/bookings/2024-04-15/controllers/bookings.controller.ts#L474-L510","documentation":"A 403 Forbidden thrown by checkBookingRequiresAuthentication when the event type requires authentication, the caller is successfully authenticated (a valid user was resolved), but the user lacks authorization for this specific event type. Authorization is granted if the user is the event type owner, a listed host, a team admin/owner of the event type's team, or an organization admin/owner of the parent org.","triggerScenarios":"POST /v2/bookings or POST /v2/bookings/recurring with valid credentials against a restricted event type, where the authenticated user is: not the owner (eventType.userId mismatch), not in the eventType.hosts array, not a team member with admin/owner role, and not an org admin/owner of the parent organization.","commonSituations":"A user was added as a regular team member (not admin) and tries to book a restricted team event type. The event type was moved to a different team and the user's membership is stale. The user belongs to a child team but the org-level check requires parent org admin role. A host was removed from the event type but still has an API key.","solutions":["Verify the authenticated user has one of: event type ownership, host membership, team admin/owner role, or org admin/owner role for this event type.","If the user should be a host, add them to the event type's hosts list in the Cal.com dashboard or via the event types API.","If the user should have team-level access, promote them to team admin or owner in the team settings.","Confirm the correct eventTypeId is being requested — a typo can point to an event type the user has no relation to."],"exampleFix":"// before — regular team member attempts to book restricted event type\nPOST /v2/bookings { eventTypeId: 42 }\n// Authorization: Bearer <regular-member-token>  -> 403\n\n// after — either promote the user to team admin or use an authorized user's token\nPOST /v2/bookings { eventTypeId: 42 }\n// Authorization: Bearer <team-admin-token>  -> 200","handlingStrategy":"validation","validationCode":"// Check if the user is authorized for the event type before booking\nasync function canUserBookEventType(userToken, eventTypeId) {\n  const res = await fetch(`/v2/event-types/${eventTypeId}`, {\n    headers: { Authorization: `Bearer ${userToken}` }\n  });\n  if (!res.ok) return false;\n  const { data } = await res.json();\n  // Verify the user is owner, host, or team/org admin\n  return data.userId === currentUserId || data.hosts?.some(h => h.userId === currentUserId);\n}\n\nif (!(await canUserBookEventType(token, eventTypeId))) {\n  throw new Error('User not authorized for this event type — request access from the team admin');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.createBooking({ eventTypeId, ... });\n} catch (err) {\n  if (err.statusCode === 403) {\n    // Surface to the user that they need elevated permissions\n    console.error('Access denied. Request team admin or owner role for event type', eventTypeId);\n  }\n  throw err;\n}","preventionTips":["Before booking, verify the authenticated user's role against the event type's team.","Use the event types API to check hosts and team membership.","Maintain a mapping of which users are authorized for which event types in your integration.","When a user joins or leaves a team, update their API tokens' associated event types."],"tags":["authorization","forbidden","rbac","event-type","team","organization","booking"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}