calcom/cal.diy · error · BadRequestException

DELEGATION_CREDENTIAL_ERROR trigger is only available for or

Error message

DELEGATION_CREDENTIAL_ERROR trigger is only available for organization webhooks

What it means

EventTypeWebhooksService.createEventTypeWebhook rejects requests whose eventTriggers array includes DELEGATION_CREDENTIAL_ERROR. That trigger is reserved exclusively for organization-scoped webhooks; event-type webhooks are not organization webhooks. The service throws BadRequestException (HTTP 400) before any persistence.

Source

Thrown at apps/api/v2/src/modules/webhooks/services/event-type-webhooks.service.ts:16

import { PipedInputWebhookType } from "@/modules/webhooks/pipes/WebhookInputPipe";
import { validateWebhookUrl } from "@/modules/webhooks/utils/validate-webhook-url";
import { WebhooksRepository } from "@/modules/webhooks/webhooks.repository";
import { BadRequestException, ConflictException, Injectable } from "@nestjs/common";

import { WebhookTriggerEvents } from "@calcom/prisma/enums";

@Injectable()
export class EventTypeWebhooksService {
  constructor(private readonly webhooksRepository: WebhooksRepository) {}

  async createEventTypeWebhook(eventTypeId: number, body: PipedInputWebhookType) {
    validateWebhookUrl(body.subscriberUrl);

    if (body.eventTriggers.includes(WebhookTriggerEvents.DELEGATION_CREDENTIAL_ERROR)) {
      throw new BadRequestException(
        "DELEGATION_CREDENTIAL_ERROR trigger is only available for organization webhooks"
      );
    }

    const existingWebhook = await this.webhooksRepository.getEventTypeWebhookByUrl(
      eventTypeId,
      body.subscriberUrl
    );
    if (existingWebhook) {
      throw new ConflictException("Webhook with this subscriber url already exists for this event type");
    }
    return this.webhooksRepository.createEventTypeWebhook(eventTypeId, {
      ...body,
      payloadTemplate: body.payloadTemplate ?? null,
      secret: body.secret ?? null,
    });
  }

View on GitHub (pinned to 176037d0af)

Solutions

1. Remove DELEGATION_CREDENTIAL_ERROR from eventTriggers when creating an event-type webhook.
2. If you genuinely need that trigger, create the webhook through the organization-webhooks endpoint instead.
3. Filter the trigger list client-side based on webhook scope before submitting.

Example fix

// before
body.eventTriggers = ['DELEGATION_CREDENTIAL_ERROR', 'BOOKING_CREATED'];
// after
body.eventTriggers = ['BOOKING_CREATED']; // org-only trigger removed

const ORG_ONLY_TRIGGERS = new Set(['DELEGATION_CREDENTIAL_ERROR']);
function cleanTriggersForEventType(triggers: string[]) {
  return triggers.filter(t => !ORG_ONLY_TRIGGERS.has(t));
}
body.eventTriggers = cleanTriggersForEventType(body.eventTriggers);

const isOrgOnlyTrigger = (t: string): boolean =>
  t === 'DELEGATION_CREDENTIAL_ERROR';

try { await api.createEventTypeWebhook(eventTypeId, body); }
catch (e) {
  if (e.status === 400 && /DELEGATION_CREDENTIAL_ERROR/.test(e.message)) {
    body.eventTriggers = body.eventTriggers.filter(t => t !== 'DELEGATION_CREDENTIAL_ERROR');
    // retry, or redirect to organization-webhooks endpoint
  } else throw e;
}

When it happens

Trigger: POST to create an event-type webhook with body.eventTriggers containing WebhookTriggerEvents.DELEGATION_CREDENTIAL_ERROR. The check fires immediately after validateWebhookUrl, before the duplicate-URL check.

Common situations: Copy-pasting a trigger list from an organization webhook payload into an event-type webhook request; UI checkbox exposing triggers that are not valid for the current webhook scope; enum drift after an upgrade that added the trigger.

Related errors

• DELEGATION_CREDENTIAL_ERROR trigger is only available for or
• DELEGATION_CREDENTIAL_ERROR trigger is only available for or
• Webhook URL is not allowed: ${validation.error}
• ApiKeysService -Cannot set both apiKeyDaysValid and apiKeyNe
• teamId is required for team events, please provide a valid t

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/f158e9afaf98979e. Report an issue: GitHub.