calcom/cal.diy · error · BadRequestException

Booking with uid does not belong to user

Error message

Booking with uid ${bookingUid} does not belong to user

What it means

Thrown in getBookingReferences when the resolved booking's user.id does not equal the authenticated userId. Notably this is a BadRequestException (HTTP 400), not a 403 — the endpoint treats ownership as an input precondition. The booking exists but does not belong to the caller.

Solutions

Use an API key belonging to the booking's owner user.
For cross-user/org access, use the org-level references endpoint (getOrgBookingReferences) instead of the per-user one.
Confirm the authenticated user id matches booking.user.id before calling.

Defensive patterns

Strategy: validation

Validate before calling

// Confirm ownership before calling the per-user references endpoint.
const me = await api.get('/v2/me');
const booking = await api.get(`/v2/bookings/${uid}`);
if (booking.user?.id !== me.id) throw new Error(`Booking ${uid} does not belong to user ${me.id}; use the org endpoint`);

Try / catch

try {
  await api.get(`/v2/bookings/${uid}/references`);
} catch (err) {
  if (err.status === 400 && /does not belong to user/.test(err.message)) {
    // switch to the org references endpoint or the booking owner's API key
  }
  throw err;
}

Prevention

Use the booking owner's API key for the per-user references endpoint.
For cross-user/org scenarios, call the org-level references endpoint.
Check booking.user.id === authenticated userId before calling.

When it happens

Trigger: GET booking references using an API key/access token whose userId differs from the booking's owner. The booking resolves (so 272 didn't fire) but booking.user?.id !== userId.

Common situations: Sharing a booking UID across users; using the wrong user's API key; booking whose owner was changed; user expected org-level access but used the per-user endpoint.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/1d5b16427c4b649c. Report an issue: GitHub.

Appendix: source

Thrown at apps/api/v2/src/platform/bookings/2024-08-13/services/booking-references.service.ts:27

  constructor(
    private readonly bookingsRepository: BookingsRepository_2024_08_13,
    private readonly bookingReferencesRepository: BookingReferencesRepository_2024_08_13,
    private readonly outputBookingReferencesService: OutputBookingReferencesService_2024_08_13
  ) {}

  async getBookingReferences(
    bookingUid: string,
    userId: number,
    filter?: BookingReferencesFilterInput_2024_08_13
  ) {
    const booking = await this.bookingsRepository.getByUidWithUser(bookingUid);

    if (!booking) {
      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);
    }

    if (booking.user?.id !== userId) {
      throw new BadRequestException(`Booking with uid ${bookingUid} does not belong to user`);
    }

    const bookingReferences = await this.bookingReferencesRepository.getBookingReferences(booking.id, filter);

    return this.outputBookingReferencesService.getOutputBookingReferences(bookingReferences);
  }

  async getOrgBookingReferences(bookingUid: string, filter?: BookingReferencesFilterInput_2024_08_13) {
    const booking = await this.bookingsRepository.getByUidWithUser(bookingUid);

    if (!booking) {
      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);
    }

    const bookingReferences = await this.bookingReferencesRepository.getBookingReferences(booking.id, filter);

    return this.outputBookingReferencesService.getOutputBookingReferences(bookingReferences);
  }

View on GitHub (pinned to 176037d0af)