calcom/cal.diy · error · BadRequestException

Booking with uid ${bookingUid} does not belong to user

Error message

Booking with uid ${bookingUid} does not belong to user

What it means

Thrown in getBookingReferences when the resolved booking's user.id does not equal the authenticated userId. Notably this is a BadRequestException (HTTP 400), not a 403 — the endpoint treats ownership as an input precondition. The booking exists but does not belong to the caller.

Source

Thrown at apps/api/v2/src/platform/bookings/2024-08-13/services/booking-references.service.ts:27

  constructor(
    private readonly bookingsRepository: BookingsRepository_2024_08_13,
    private readonly bookingReferencesRepository: BookingReferencesRepository_2024_08_13,
    private readonly outputBookingReferencesService: OutputBookingReferencesService_2024_08_13
  ) {}

  async getBookingReferences(
    bookingUid: string,
    userId: number,
    filter?: BookingReferencesFilterInput_2024_08_13
  ) {
    const booking = await this.bookingsRepository.getByUidWithUser(bookingUid);

    if (!booking) {
      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);
    }

    if (booking.user?.id !== userId) {
      throw new BadRequestException(`Booking with uid ${bookingUid} does not belong to user`);
    }

    const bookingReferences = await this.bookingReferencesRepository.getBookingReferences(booking.id, filter);

    return this.outputBookingReferencesService.getOutputBookingReferences(bookingReferences);
  }

  async getOrgBookingReferences(bookingUid: string, filter?: BookingReferencesFilterInput_2024_08_13) {
    const booking = await this.bookingsRepository.getByUidWithUser(bookingUid);

    if (!booking) {
      throw new NotFoundException(`Booking with uid ${bookingUid} not found`);
    }

    const bookingReferences = await this.bookingReferencesRepository.getBookingReferences(booking.id, filter);

    return this.outputBookingReferencesService.getOutputBookingReferences(bookingReferences);
  }

View on GitHub (pinned to 176037d0af)

Solutions

1. Use an API key belonging to the booking's owner user.
2. For cross-user/org access, use the org-level references endpoint (getOrgBookingReferences) instead of the per-user one.
3. Confirm the authenticated user id matches booking.user.id before calling.

// Confirm ownership before calling the per-user references endpoint.
const me = await api.get('/v2/me');
const booking = await api.get(`/v2/bookings/${uid}`);
if (booking.user?.id !== me.id) throw new Error(`Booking ${uid} does not belong to user ${me.id}; use the org endpoint`);

try {
  await api.get(`/v2/bookings/${uid}/references`);
} catch (err) {
  if (err.status === 400 && /does not belong to user/.test(err.message)) {
    // switch to the org references endpoint or the booking owner's API key
  }
  throw err;
}

When it happens

Trigger: GET booking references using an API key/access token whose userId differs from the booking's owner. The booking resolves (so 272 didn't fire) but booking.user?.id !== userId.

Common situations: Sharing a booking UID across users; using the wrong user's API key; booking whose owner was changed; user expected org-level access but used the per-user endpoint.

Related errors

• You are not authorized to book this event type. You must be
• BookingPbacGuard - user with id=${user.id} does not have acc
• Booking with uid ${bookingUid} not found
• Event type with id=${eventType.id} is the parent managed eve
• checkBookingRequiresAuthentication - user is not authorized

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/1d5b16427c4b649c. Report an issue: GitHub.