calcom/cal.diy · error · NotFoundException

Event type with id ${eventTypeId} not found

Error message

Event type with id ${eventTypeId} not found

What it means

Thrown by EventTypesController_2024_06_14.getEventTypeById (GET /v2/event-types/:eventTypeId with cal-api-version 2024-06-14) when eventTypesService.getEventTypeByIdIfAuthorized returns null. Null means the event type does not exist OR the authenticated user lacks access (not owner, host, team admin, or org admin). The controller conflates the two into a single 404 to avoid leaking existence.

Source

Thrown at apps/api/v2/src/platform/event-types/event-types_2024_06_14/controllers/event-types.controller.ts:133

    
    Access control: This endpoint fetches an event type by ID and returns it only if the authenticated user is authorized. Authorization is granted to:
    - System admins
    - The event type owner
    - Hosts of the event type or users assigned to the event type
    - Team admins/owners of the team that owns the team event type
    - Organization admins/owners of the event type owner's organization
    - Organization admins/owners of the team's parent organization

    Note: Update and delete endpoints remain restricted to the event type owner only.`,
  })
  async getEventTypeById(
    @Param("eventTypeId") eventTypeId: string,
    @GetUser() user: ApiAuthGuardUser
  ): Promise<GetEventTypeOutput_2024_06_14> {
    const eventType = await this.eventTypesService.getEventTypeByIdIfAuthorized(user, Number(eventTypeId));

    if (!eventType) {
      throw new NotFoundException(`Event type with id ${eventTypeId} not found`);
    }

    const responseEventType = this.isTeamEventType(eventType)
      ? await this.outputTeamEventTypesResponsePipe.transform(eventType)
      : this.eventTypeResponseTransformPipe.transform(eventType);

    return {
      status: SUCCESS_STATUS,
      data: responseEventType,
    };
  }

  private isTeamEventType(
    eventType: DatabaseTeamEventType | ({ ownerId: number } & DatabaseEventType)
  ): eventType is DatabaseTeamEventType {
    return !!eventType.teamId;
  }

View on GitHub (pinned to 176037d0af)

Solutions

  1. Confirm the authenticated user is the owner, a host, a team admin, or an org admin of the event type.
  2. List event types via GET /v2/event-types (which only returns authorized ones) and use an id from that set.
  3. For team event types, verify the user's team membership and role.
  4. If access should be granted, check the EventTypeAccessService rules and the user's memberships.

Example fix

// before
const et = await api.get(`/v2/event-types/${id}`, { headers: { 'cal-api-version': '2024-06-14' } });
// after
const visible = (await api.get('/v2/event-types', { headers: { 'cal-api-version': '2024-06-14' } })).data;
if (!visible.some(e => e.id === id)) throw new Error('no access to event type');
const et = await api.get(`/v2/event-types/${id}`, { headers: { 'cal-api-version': '2024-06-14' } });
Defensive patterns

Strategy: validation

Validate before calling

// Confirm the authenticated user can see the event type via the scoped list
const visible = (await api.get('/v2/event-types', { headers: { 'cal-api-version': '2024-06-14' } })).data ?? [];
if (!visible.some((e) => e.id === eventTypeId)) {
  throw new Error(`no authorized access to event type ${eventTypeId}`);
}

Type guard

function isAuthorizedId(list: unknown, id: number): boolean {
  return Array.isArray(list) && list.some((e) => typeof e === 'object' && e !== null && (e as any).id === id);
}

Try / catch

try {
  return await api.get(`/v2/event-types/${id}`, { headers: { 'cal-api-version': '2024-06-14' } });
} catch (e) {
  if (e.response?.status === 404) {
    // not found OR not authorized — prompt re-auth or pick from the visible list
  } else throw e;
}

Prevention

When it happens

Trigger: GET /v2/event-types/999 with a non-existent id; GET for an event type where the user is not the owner, not a host, not a team admin of the owning team, and not an org admin of the owning org; the id exists but is a team event type the user cannot see.

Common situations: Cross-tenant access attempts; a user freshly added to a team before propagation; an event type moved to a different org; using a personal token to read a team event type the user is not a host of.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/8731a81f32365127. Report an issue: GitHub.