{"record":{"id":"f158e9afaf98979e","repo":"calcom/cal.diy","slug":"delegation-credential-error-trigger-is-only-availa","errorCode":null,"errorMessage":"DELEGATION_CREDENTIAL_ERROR trigger is only available for organization webhooks","messagePattern":"DELEGATION_CREDENTIAL_ERROR trigger is only available for organization webhooks","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/api/v2/src/modules/webhooks/services/event-type-webhooks.service.ts","lineNumber":16,"sourceCode":"import { PipedInputWebhookType } from \"@/modules/webhooks/pipes/WebhookInputPipe\";\nimport { validateWebhookUrl } from \"@/modules/webhooks/utils/validate-webhook-url\";\nimport { WebhooksRepository } from \"@/modules/webhooks/webhooks.repository\";\nimport { BadRequestException, ConflictException, Injectable } from \"@nestjs/common\";\n\nimport { WebhookTriggerEvents } from \"@calcom/prisma/enums\";\n\n@Injectable()\nexport class EventTypeWebhooksService {\n  constructor(private readonly webhooksRepository: WebhooksRepository) {}\n\n  async createEventTypeWebhook(eventTypeId: number, body: PipedInputWebhookType) {\n    validateWebhookUrl(body.subscriberUrl);\n\n    if (body.eventTriggers.includes(WebhookTriggerEvents.DELEGATION_CREDENTIAL_ERROR)) {\n      throw new BadRequestException(\n        \"DELEGATION_CREDENTIAL_ERROR trigger is only available for organization webhooks\"\n      );\n    }\n\n    const existingWebhook = await this.webhooksRepository.getEventTypeWebhookByUrl(\n      eventTypeId,\n      body.subscriberUrl\n    );\n    if (existingWebhook) {\n      throw new ConflictException(\"Webhook with this subscriber url already exists for this event type\");\n    }\n    return this.webhooksRepository.createEventTypeWebhook(eventTypeId, {\n      ...body,\n      payloadTemplate: body.payloadTemplate ?? null,\n      secret: body.secret ?? null,\n    });\n  }\n","sourceCodeStart":1,"sourceCodeEnd":34,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/webhooks/services/event-type-webhooks.service.ts#L1-L34","documentation":"EventTypeWebhooksService.createEventTypeWebhook rejects requests whose eventTriggers array includes DELEGATION_CREDENTIAL_ERROR. That trigger is reserved exclusively for organization-scoped webhooks; event-type webhooks are not organization webhooks. The service throws BadRequestException (HTTP 400) before any persistence.","triggerScenarios":"POST to create an event-type webhook with body.eventTriggers containing WebhookTriggerEvents.DELEGATION_CREDENTIAL_ERROR. The check fires immediately after validateWebhookUrl, before the duplicate-URL check.","commonSituations":"Copy-pasting a trigger list from an organization webhook payload into an event-type webhook request; UI checkbox exposing triggers that are not valid for the current webhook scope; enum drift after an upgrade that added the trigger.","solutions":["Remove DELEGATION_CREDENTIAL_ERROR from eventTriggers when creating an event-type webhook.","If you genuinely need that trigger, create the webhook through the organization-webhooks endpoint instead.","Filter the trigger list client-side based on webhook scope before submitting."],"exampleFix":"// before\nbody.eventTriggers = ['DELEGATION_CREDENTIAL_ERROR', 'BOOKING_CREATED'];\n// after\nbody.eventTriggers = ['BOOKING_CREATED']; // org-only trigger removed","handlingStrategy":"validation","validationCode":"const ORG_ONLY_TRIGGERS = new Set(['DELEGATION_CREDENTIAL_ERROR']);\nfunction cleanTriggersForEventType(triggers: string[]) {\n  return triggers.filter(t => !ORG_ONLY_TRIGGERS.has(t));\n}\nbody.eventTriggers = cleanTriggersForEventType(body.eventTriggers);","typeGuard":"const isOrgOnlyTrigger = (t: string): boolean =>\n  t === 'DELEGATION_CREDENTIAL_ERROR';","tryCatchPattern":"try { await api.createEventTypeWebhook(eventTypeId, body); }\ncatch (e) {\n  if (e.status === 400 && /DELEGATION_CREDENTIAL_ERROR/.test(e.message)) {\n    body.eventTriggers = body.eventTriggers.filter(t => t !== 'DELEGATION_CREDENTIAL_ERROR');\n    // retry, or redirect to organization-webhooks endpoint\n  } else throw e;\n}","preventionTips":["Maintain a per-scope allow-list of triggers in the client and filter before submit.","Surface scope (event-type vs organization) on the trigger-selection UI.","Document the org-only triggers explicitly for integrators."],"tags":["webhooks","validation","event-triggers","bad-request"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}