calcom/cal.diy · error · BadRequestException

BookingUidGuard - Booking UID missing in the request path

Error message

BookingUidGuard - Booking UID missing in the request path

What it means

A 400 BadRequestException thrown by BookingUidGuard (a lightweight sync guard) when request.params.bookingUid is falsy. Unlike BookingPbacGuard, this guard only checks param presence — no user or access checks. It's used on routes that need the UID present but delegate authorization elsewhere.

Source

Thrown at apps/api/v2/src/platform/bookings/2024-08-13/guards/booking-uid.guard.ts:11

import { Injectable, CanActivate, ExecutionContext, BadRequestException } from "@nestjs/common";

@Injectable()
export class BookingUidGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();

    const bookingUid = request.params.bookingUid;

    if (!bookingUid) {
      throw new BadRequestException("BookingUidGuard - Booking UID missing in the request path");
    }

    return true;
  }
}

View on GitHub (pinned to 176037d0af)

Solutions

Include the bookingUid in the request URL path, e.g., GET /v2/bookings/{bookingUid}/attendees instead of GET /v2/bookings/attendees.
Verify the route's @Controller or @Get/@Patch/@Delete decorator path includes :bookingUid.
Ensure the @Param decorator reads 'bookingUid' — a mismatch like @Param('id') would leave params.bookingUid undefined.
Check client-side URL construction for off-by-one or missing segment bugs.

Example fix

// before — client omits bookingUid from path
GET /v2/bookings//attendees

// after — include bookingUid
GET /v2/bookings/abc-123-def/attendees

Defensive patterns

Strategy: validation

Validate before calling

// Ensure bookingUid is present in the path
function buildBookingUrl(basePath, bookingUid, suffix) {
  if (!bookingUid) throw new Error('bookingUid is required');
  return `${basePath}/${bookingUid}${suffix || ''}`;
}

const url = buildBookingUrl('/v2/bookings', bookingUid, '/attendees');

Try / catch

try {
  await api.getBookingAttendees(bookingUid);
} catch (err) {
  if (err.statusCode === 400 && err.message.includes('Booking UID missing')) {
    throw new Error('Client error: bookingUid was not provided in the URL');
  }
  throw err;
}

Prevention

Always include the bookingUid as a URL path segment.
Use a typed API client that requires the bookingUid parameter.
Validate the bookingUid before constructing the URL.
Add integration tests that verify URL construction includes all required path segments.

When it happens

Trigger: Any route decorated with BookingUidGuard where the HTTP request URL omits the :bookingUid path segment. This guard runs synchronously (canActivate returns boolean, not Promise) and fails fast before the controller method executes.

Common situations: Client sends a request to a URL pattern that doesn't include the booking UID. Route path template was changed without updating the guard's param read. The bookingUid param name in the route doesn't match 'bookingUid'. A misconfigured API gateway strips path segments.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/97d3dca55f2de1a7. Report an issue: GitHub.