diff --git a/pages/api/attendees/[id].ts b/pages/api/attendees/[id].ts
index 3eba0891f2..03133bf526 100644
--- a/pages/api/attendees/[id].ts
+++ b/pages/api/attendees/[id].ts
@@ -100,7 +100,8 @@ export async function attendeeById(req: NextApiRequest, res: NextApiResponse<Att
   const attendees = userBookings.map((booking) => booking.attendees).flat();
   const attendeeIds = attendees.map((attendee) => attendee.id);
   // Here we make sure to only return attendee's of the user's own bookings.
-  if (attendeeIds.includes(safeQuery.data.id)) {
+  if (!attendeeIds.includes(safeQuery.data.id))  res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.attendee
@@ -151,7 +152,7 @@ export async function attendeeById(req: NextApiRequest, res: NextApiResponse<Att
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(attendeeById));
diff --git a/pages/api/attendees/index.ts b/pages/api/attendees/index.ts
index 6a3880bf3c..92335c3570 100644
--- a/pages/api/attendees/index.ts
+++ b/pages/api/attendees/index.ts
@@ -76,7 +76,8 @@ async function createOrlistAllAttendees(
       throw new Error("User not found");
     }
     const userBookingIds = userWithBookings.bookings.map((booking: any) => booking.id).flat();
-    if (userBookingIds.includes(bookingId)) {
+    if (!userBookingIds.includes(bookingId)) res.status(401).json({ message: "Unauthorized" });
+    else {
       delete safe.data.bookingId;
       const noBookingId = safe.data;
       const data = await prisma.attendee.create({
@@ -99,7 +100,7 @@ async function createOrlistAllAttendees(
             error,
           });
       }
-    } else res.status(401).json({ message: "Unauthorized" });
+    }
   } else res.status(405).json({ message: `Method ${method} not allowed` });
 }