calcom/cal.diy · warning · HttpCode

Method Not Allowed

Error message

Method Not Allowed

What it means

Thrown by the Alby webhook handler when the request method is anything other than POST. Alby/Svix deliver webhook events as POST, so GET/HEAD probes are rejected with HTTP 405.

Source

Thrown at packages/app-store/alby/api/webhook.ts:23

import { handlePaymentSuccess } from "@calcom/app-store/_utils/payments/handlePaymentSuccess";
import { distributedTracing } from "@calcom/lib/tracing/factory";
import { albyCredentialKeysSchema } from "@calcom/app-store/alby/lib";
import parseInvoice from "@calcom/app-store/alby/lib/parseInvoice";
import { IS_PRODUCTION } from "@calcom/lib/constants";
import { HttpError as HttpCode } from "@calcom/lib/http-error";
import { getServerErrorFromUnknown } from "@calcom/lib/server/getServerErrorFromUnknown";
import prisma from "@calcom/prisma";

export const config = {
  api: {
    bodyParser: false,
  },
};

export default async function handler(req: NextApiRequest, res: NextApiResponse) {
  try {
    if (req.method !== "POST") {
      throw new HttpCode({ statusCode: 405, message: "Method Not Allowed" });
    }

    const bodyRaw = await getRawBody(req);
    const headers = req.headers;
    const bodyAsString = bodyRaw.toString();

    const parseHeaders = webhookHeadersSchema.safeParse(headers);
    if (!parseHeaders.success) {
      console.error(parseHeaders.error);
      throw new HttpCode({ statusCode: 400, message: "Bad Request" });
    }

    const { data: parsedHeaders } = parseHeaders;

    const parse = eventSchema.safeParse(JSON.parse(bodyAsString));
    if (!parse.success) {
      console.error(parse.error);
      throw new HttpCode({ statusCode: 400, message: "Bad Request" });

View on GitHub (pinned to 176037d0af)

Solutions

1. Send only POST to the webhook - Alby/Svix always uses POST.
2. Use a separate dedicated health endpoint for GET-based uptime checks.
3. Verify the Alby webhook configuration points to this exact URL and method.

if (req.method !== 'POST') {
  // return 405 from a GET health endpoint instead of the webhook
}

When it happens

Trigger: An uptime/healthcheck bot hitting /api/alby/webhook with GET; a misconfigured webhook source retrying with GET; a browser navigation or prefetch to the URL.

Common situations: Monitoring tools pinging the webhook URL; sharing the webhook endpoint with a GET-based status check; manual browser open of the URL.

Related errors

• Bad Request
• Invoice not found
• Payment not for cal.com
• Payment not found
• Credentials not found

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/2fb67e716a0bca60. Report an issue: GitHub.