{"record":{"id":"4ce1e89c54a67af2","repo":"calcom/cal.diy","slug":"you-cannot-create-a-managed-user-outside-of-an-org","errorCode":null,"errorMessage":"You cannot create a managed user outside of an organization - the OAuth client does not belong to any organization.","messagePattern":"You cannot create a managed user outside of an organization - the OAuth client does not belong to any organization\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/api/v2/src/modules/oauth-clients/services/oauth-clients-users.service.ts","lineNumber":41,"sourceCode":"    private readonly schedulesService: SchedulesService_2024_04_15,\n    private readonly calendarsService: CalendarsService,\n    private readonly profilesRepository: ProfilesRepository\n  ) {}\n\n  async createOAuthClientUser(oAuthClient: PlatformOAuthClient, body: CreateManagedUserInput) {\n    const oAuthClientId = oAuthClient.id;\n    const organizationId = oAuthClient.organizationId;\n\n    const existingUser = await this.getExistingUserByEmail(oAuthClientId, body.email);\n    if (existingUser) {\n      throw new ConflictException(\n        `User with the provided e-mail already exists. Existing user ID=${existingUser.id}`\n      );\n    }\n\n    let user: User;\n    if (!organizationId) {\n      throw new BadRequestException(\n        \"You cannot create a managed user outside of an organization - the OAuth client does not belong to any organization.\"\n      );\n    } else {\n      const email = OAuthClientUsersService.getOAuthUserEmail(oAuthClientId, body.email);\n      const createdUser = (\n        await createNewUsersConnectToOrgIfExists({\n          invitations: [\n            {\n              usernameOrEmail: email,\n              role: \"MEMBER\",\n            },\n          ],\n          creationSource: CreationSource.API_V2,\n          teamId: organizationId,\n          isOrg: true,\n          parentId: null,\n          autoAcceptEmailDomain: \"never-auto-accept-email-domain-for-managed-users\",\n          orgConnectInfoByUsernameOrEmail: {","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/oauth-clients/services/oauth-clients-users.service.ts#L23-L59","documentation":"Thrown by createOAuthClientUser when oAuthClient.organizationId is null/undefined. Managed users are organization-scoped by design; an OAuth client that is not bound to an organization cannot host managed users, so the create is rejected up front with BadRequestException (HTTP 400) before any user record is touched.","triggerScenarios":"Calling managed-user creation with an OAuth client whose organizationId is null. This reflects a client created outside the org-owned flow (legacy or misconfigured client).","commonSituations":"A legacy OAuth client predating the org requirement; a client created via a path that didn't set organizationId; using a personal-level client for org-scoped managed-user provisioning.","solutions":["Ensure the OAuth client is created under an organization so organizationId is set.","Recreate or migrate the client so it is bound to the intended organization.","Before provisioning, assert oAuthClient.organizationId is non-null.","If org-less provisioning is genuinely required, reconsider — the API forbids it by design."],"exampleFix":"// before\nconst client = await getOrglessClient();\nawait oauthClientUsersService.createOAuthClientUser(client, { email }); // 400\n\n// after — bind the client to an org first\nconst client = await createOAuthClientInOrg(orgId, payload);\nawait oauthClientUsersService.createOAuthClientUser(client, { email });","handlingStrategy":"validation","validationCode":"// Assert the client is org-bound before provisioning managed users\nfunction assertClientHasOrg(client: { organizationId: number | null }) {\n  if (!client.organizationId) {\n    throw new Error('Cannot provision managed users: OAuth client has no organization');\n  }\n}\nawait assertClientHasOrg(oAuthClient);","typeGuard":"function isOrgBoundClient(client: unknown): client is { organizationId: number } {\n  return typeof (client as any)?.organizationId === 'number' && (client as any).organizationId > 0;\n}","tryCatchPattern":"// Validate up front; a missing org is a configuration defect, not a transient error.","preventionTips":["Create OAuth clients under an organization so organizationId is set.","Assert client.organizationId is non-null before any managed-user create.","Migrate legacy org-less clients into an org."],"tags":["oauth","organization","configuration","validation","managed-user"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}