calcom/cal.diy · error · BadRequestException

Trying to reschedule an event-type which requires authentica

Error message

Trying to reschedule an event-type which requires authentication but provided invalid rescheduleUid.

What it means

A 400 BadRequest thrown by checkBookingRequiresAuthentication when the target event type has bookingRequiresAuthentication enabled, the caller provided a rescheduleUid, but isValidRescheduleBooking returned false. isValidRescheduleBooking checks three things: the booking must exist, its status must be ACCEPTED or PENDING, and its eventTypeId must match the requested eventTypeId.

Source

Thrown at apps/api/v2/src/platform/bookings/2024-04-15/controllers/bookings.controller.ts:459

  private async checkBookingRequiresAuthentication(
    req: Request,
    eventTypeId: number,
    rescheduleUid?: string
  ): Promise<void> {
    const eventType = await this.eventTypeRepository.findByIdIncludeHostsAndTeamMembers({
      id: eventTypeId,
    });

    if (!eventType?.bookingRequiresAuthentication) {
      return;
    }

    if (rescheduleUid) {
      const isValidRescheduleBooking = await this.isValidRescheduleBooking(rescheduleUid, eventTypeId);
      if (isValidRescheduleBooking) {
        return;
      } else {
        throw new BadRequestException(
          "Trying to reschedule an event-type which requires authentication but provided invalid rescheduleUid."
        );
      }
    }

    const owner = await this.getOwner(req);
    const userId = owner?.id;

    if (!userId) {
      throw new UnauthorizedException(
        "This event type requires authentication. Please provide valid credentials."
      );
    }

    const isEventTypeOwner = eventType.userId === userId;
    const isHost = eventType.hosts.some((host) => host.userId === userId);
    const isTeamAdminOrOwner = eventType.team?.members.some((member) => member.userId === userId) ?? false;

View on GitHub (pinned to 176037d0af)

Solutions

Verify the rescheduleUid corresponds to a valid, non-cancelled booking by calling GET /v2/bookings/:bookingUid first.
Ensure the eventTypeId in the request body matches the event type of the original booking referenced by rescheduleUid.
If the original booking was cancelled, create a new booking instead of rescheduling.
Check that the rescheduleUid hasn't already been used for a successful reschedule (which may have changed its status).

Example fix

// before — client sends mismatched eventTypeId
POST /v2/bookings { eventTypeId: 10, rescheduleUid: "abc-123" }

// after — fetch the original booking first, match its eventTypeId
const original = await fetch(`/v2/bookings/${rescheduleUid}`);
POST /v2/bookings { eventTypeId: original.eventTypeId, rescheduleUid: "abc-123" }

Defensive patterns

Strategy: validation

Validate before calling

// Before calling POST /v2/bookings with a rescheduleUid, validate it
async function isValidRescheduleUid(rescheduleUid, eventTypeId) {
  const res = await fetch(`/v2/bookings/${rescheduleUid}`);
  if (!res.ok) return false;
  const { data } = await res.json();
  // Must exist, be ACCEPTED/PENDING, and match the eventTypeId
  return (
    data &&
    ['ACCEPTED', 'PENDING'].includes(data.status) &&
    data.eventTypeId === eventTypeId
  );
}

if (rescheduleUid && !(await isValidRescheduleUid(rescheduleUid, eventTypeId))) {
  throw new Error('Invalid rescheduleUid — create a new booking instead');
}

Try / catch

try {
  await api.createBooking({ eventTypeId, rescheduleUid, ... });
} catch (err) {
  if (err.statusCode === 400 && err.message.includes('invalid rescheduleUid')) {
    // Discard the stale rescheduleUid and create a fresh booking
    await api.createBooking({ eventTypeId, ... }); // without rescheduleUid
  } else {
    throw err;
  }
}

Prevention

Always fetch the original booking by UID before rescheduling to verify it exists and matches the event type.
Discard rescheduleUids from cancelled bookings — they cannot be rescheduled.
Store the eventTypeId alongside the bookingUid in your system to avoid mismatches.
Test reschedule flows against non-authenticated event types first to isolate auth-specific issues.

When it happens

Trigger: POST /v2/bookings or POST /v2/bookings/recurring with a rescheduleUid and an eventTypeId where: (a) the rescheduleUid doesn't correspond to any booking, (b) the referenced booking is CANCELLED/REJECTED, or (c) the rescheduleUid belongs to a booking for a different event type than the one in the request body.

Common situations: Client sends a stale or copy-pasted rescheduleUid from a different event type. The original booking was already cancelled and the client is retrying. The eventTypeId in the body was changed but the rescheduleUid wasn't updated. Mismatched eventTypeId across recurring series members.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/0adf3eb557affdc5. Report an issue: GitHub.