{"record":{"id":"3e502af51479812e","repo":"calcom/cal.diy","slug":"checkbookingrequiresauthentication-user-is-not-a","errorCode":null,"errorMessage":"checkBookingRequiresAuthentication - user is not authorized to access this event type. User has to be either event type owner, host, team admin or owner or org admin or owner.","messagePattern":"checkBookingRequiresAuthentication - user is not authorized to access this event type\\. User has to be either event type owner, host, team admin or owner or org admin or owner\\.","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"apps/api/v2/src/platform/bookings/2024-08-13/services/bookings.service.ts","lineNumber":182,"sourceCode":"        `Can't book this team event type because it has no hosts. Please, add at least 1 host to event type with id=${eventTypeId} belonging to team with id=${eventType?.teamId} and try again.`\n      );\n    }\n  }\n\n  async checkBookingRequiresAuthenticationSetting(\n    eventType: EventTypeWithOwnerAndTeam,\n    authUser: AuthOptionalUser,\n    userIsEventTypeAdminOrOwner: boolean\n  ) {\n    if (!eventType.bookingRequiresAuthentication) return true;\n    if (!authUser) {\n      throw new UnauthorizedException(\n        \"checkBookingRequiresAuthentication - request must be authenticated by passing credentials belonging to event type owner, host or team or org admin or owner.\"\n      );\n    }\n\n    if (!userIsEventTypeAdminOrOwner) {\n      throw new ForbiddenException(\n        \"checkBookingRequiresAuthentication - user is not authorized to access this event type. User has to be either event type owner, host, team admin or owner or org admin or owner.\"\n      );\n    }\n  }\n\n  async getBookedEventType(body: CreateBookingInput) {\n    if (body.eventTypeId) {\n      return await this.eventTypesRepository.getEventTypeByIdWithOwnerAndTeam(body.eventTypeId);\n    } else if (body.username && body.eventTypeSlug) {\n      const user = await this.usersRepository.findByUsername(body.username, body.organizationSlug);\n      if (!user) {\n        throw new NotFoundException(`User with username ${body.username} not found`);\n      }\n      return await this.eventTypesRepository.getUserEventTypeBySlugWithOwnerAndTeam(\n        user.id,\n        body.eventTypeSlug\n      );\n    } else if (body.teamSlug && body.eventTypeSlug) {","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/platform/bookings/2024-08-13/services/bookings.service.ts#L164-L200","documentation":"Thrown in checkBookingRequiresAuthenticationSetting when the event type requires auth, the request IS authenticated (authUser present), but eventTypeAccessService.userIsEventTypeAdminOrOwner returns false — the authenticated user is not the event type owner/host nor a team/org admin/owner. HTTP 403.","triggerScenarios":"POST /v2/bookings with credentials of a user who lacks admin/owner rights over a bookingRequiresAuthentication event type.","commonSituations":"Using a regular member's credentials instead of an owner/admin; wrong team's API key; org member vs org admin role mismatch; host was removed from the event type.","solutions":["Use credentials of an authorized user: event type owner, a host, or a team/org admin/owner.","Grant the authenticated user the appropriate team-admin or org-admin/owner role.","Confirm the authenticated user is still listed as owner/host of the event type."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before booking a protected event type, confirm the caller is authorized.\nconst eventType = await api.get(`/v2/event-types/${eventTypeId}`);\nif (eventType.bookingRequiresAuthentication) {\n  // use credentials of the owner / host / team or org admin; otherwise expect 403\n  if (!isOwnerOrAdmin(currentUser, eventType)) throw new Error('Caller is not authorized for this protected event type');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.post('/v2/bookings', body);\n} catch (err) {\n  if (err.status === 403 && /not authorized to access this event type/.test(err.message)) {\n    // switch to an owner/admin token, or grant the user the required role\n  }\n  throw err;\n}","preventionTips":["Use credentials of an owner/host/team-admin/org-admin for protected event types.","Confirm the authenticated user's role over the team/org before booking.","Keep host membership current when event types require authentication."],"tags":["authorization","booking","event-type","forbidden"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}