calcom/cal.diy · error · BadRequestException

BookingPbacGuard - bookingUid is required

Error message

BookingPbacGuard - bookingUid is required

What it means

A 400 BadRequestException thrown by BookingPbacGuard when request.params.bookingUid is falsy (null, undefined, or empty string). The guard expects the route path to include a :bookingUid parameter segment. If the route is misconfigured or the request URL omits the parameter, this error fires.

Source

Thrown at apps/api/v2/src/platform/bookings/2024-08-13/guards/booking-pbac.guard.ts:39

      this.prismaReadService.prisma
    );
  }

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context
      .switchToHttp()
      .getRequest<
        Request & { user?: ApiAuthGuardUser; pbacAuthorizedRequest?: boolean }
      >();
    const user = request.user;
    const bookingUid = request.params.bookingUid;

    if (!user) {
      throw new UnauthorizedException();
    }

    if (!bookingUid) {
      throw new BadRequestException(
        "BookingPbacGuard - bookingUid is required"
      );
    }

    const hasAccess =
      await this.bookingAccessService.doesUserIdHaveAccessToBooking({
        userId: user.id,
        bookingUid,
      });

    if (!hasAccess) {
      throw new ForbiddenException(
        `BookingPbacGuard - user with id=${user.id} does not have access to booking with uid=${bookingUid}`
      );
    }

    request.pbacAuthorizedRequest = true;
    return true;

View on GitHub (pinned to 176037d0af)

Solutions

  1. Ensure the request URL includes the bookingUid path segment: PATCH /v2/bookings/{bookingUid} not PATCH /v2/bookings/.
  2. Verify the controller's route decorator uses @Param('bookingUid') and the path includes :bookingUid.
  3. Check for URL-rewriting middleware or reverse proxy rules that strip path segments.
  4. If the param name differs, update the guard to read the correct param name or rename the route param.

Example fix

// before — client sends request without bookingUid
PATCH /v2/bookings/

// after — include the booking UID in the path
PATCH /v2/bookings/abc-123-def-456
Defensive patterns

Strategy: validation

Validate before calling

// Validate the bookingUid is present before making the API call
function validateBookingUid(bookingUid) {
  if (!bookingUid || typeof bookingUid !== 'string' || bookingUid.trim() === '') {
    throw new Error('bookingUid is required and must be a non-empty string');
  }
  return bookingUid;
}

const uid = validateBookingUid(bookingUid);
await api.updateBooking(uid, updates);

Try / catch

try {
  await api.updateBooking(bookingUid, updates);
} catch (err) {
  if (err.statusCode === 400 && err.message.includes('bookingUid is required')) {
    throw new Error('Client bug: bookingUid was not included in the URL path');
  }
  throw err;
}

Prevention

When it happens

Trigger: A route decorated with BookingPbacGuard where the HTTP request URL doesn't include the bookingUid path segment, or the route path template doesn't have :bookingUid defined. For example, calling PATCH /v2/bookings/ instead of PATCH /v2/bookings/abc-123-def.

Common situations: Client constructs the URL incorrectly (trailing slash, missing UID). The route controller path was changed (e.g., from /:bookingUid to /:id) but the guard still reads params.bookingUid. A NestJS routing misconfiguration where the param name doesn't match. The bookingUid was URL-encoded or stripped by a proxy.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/ee504fa4d0769a86. Report an issue: GitHub.