diff --git a/pages/api/availabilities/[id].ts b/pages/api/availabilities/[id].ts
index 546fbe0ce1..7d5bfb8b91 100644
--- a/pages/api/availabilities/[id].ts
+++ b/pages/api/availabilities/[id].ts
@@ -99,7 +99,8 @@ export async function availabilityById(req: NextApiRequest, res: NextApiResponse
   const userId = req.userId;
   const data = await prisma.availability.findMany({ where: { userId } });
   const availabiltiesIds = data.map((availability) => availability.id);
-  if (availabiltiesIds.includes(safeQuery.data.id)) {
+  if (!availabiltiesIds.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.availability
@@ -142,8 +143,6 @@ export async function availabilityById(req: NextApiRequest, res: NextApiResponse
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else {
-    res.status(401).json({ message: "Unauthorized" });
   }
 }
 
diff --git a/pages/api/booking-references/index.ts b/pages/api/booking-references/index.ts
index 03bc700596..74ae942dd2 100644
--- a/pages/api/booking-references/index.ts
+++ b/pages/api/booking-references/index.ts
@@ -80,7 +80,8 @@ async function createOrlistAllBookingReferences(
       throw new Error("User not found");
     }
     const userBookingIds = userWithBookings.bookings.map((booking: any) => booking.id).flat();
-    if (userBookingIds.includes(safe.data.bookingId)) {
+    if (!userBookingIds.includes(safe.data.bookingId)) res.status(401).json({ message: "Unauthorized" });
+    else {
       const booking_reference = await prisma.bookingReference.create({
         data: { ...safe.data },
       });
@@ -96,7 +97,7 @@ async function createOrlistAllBookingReferences(
             error,
           });
       }
-    } else res.status(401).json({ message: "Unauthorized" });
+    }
   } else res.status(405).json({ message: `Method ${method} not allowed` });
 }
 
diff --git a/pages/api/bookings/[id].ts b/pages/api/bookings/[id].ts
index f40ae3ccbd..9172b7dc90 100644
--- a/pages/api/bookings/[id].ts
+++ b/pages/api/bookings/[id].ts
@@ -97,7 +97,8 @@ export async function bookingById(req: NextApiRequest, res: NextApiResponse<Book
   });
   if (!userWithBookings) throw new Error("User not found");
   const userBookingIds = userWithBookings.bookings.map((booking: any) => booking.id).flat();
-  if (userBookingIds.includes(safeQuery.data.id)) {
+  if (!userBookingIds.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.booking
@@ -151,7 +152,7 @@ export async function bookingById(req: NextApiRequest, res: NextApiResponse<Book
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(bookingById));
diff --git a/pages/api/daily-event-references/[id].ts b/pages/api/daily-event-references/[id].ts
index 993e47ed57..b8bb8dc88c 100644
--- a/pages/api/daily-event-references/[id].ts
+++ b/pages/api/daily-event-references/[id].ts
@@ -105,7 +105,9 @@ export async function dailyEventReferenceById(
   const userBookingDailyEventReferenceIds = userBookingDailyEventReferences.map(
     (dailyEventReference) => dailyEventReference.id
   );
-  if (userBookingDailyEventReferenceIds.includes(safeQuery.data.id)) {
+  if (!userBookingDailyEventReferenceIds.includes(safeQuery.data.id))
+    res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.dailyEventReference
@@ -158,7 +160,7 @@ export async function dailyEventReferenceById(
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(
diff --git a/pages/api/destination-calendars/[id].ts b/pages/api/destination-calendars/[id].ts
index 579ba83482..2f643d4120 100644
--- a/pages/api/destination-calendars/[id].ts
+++ b/pages/api/destination-calendars/[id].ts
@@ -101,7 +101,8 @@ export async function destionationCalendarById(
   const userDestinationCalendars = data.map((destinationCalendar) => destinationCalendar.id);
   //  FIXME: Should we also check ownership of bokingId and eventTypeId to avoid users cross-pollinating other users calendars.
   // On a related note, moving from sequential integer IDs to UUIDs would be a good idea. and maybe help avoid having this problem.
-  if (userDestinationCalendars.includes(safeQuery.data.id)) {
+  if (userDestinationCalendars.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.destinationCalendar
@@ -154,7 +155,7 @@ export async function destionationCalendarById(
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(
diff --git a/pages/api/event-type-custom-inputs/[id].ts b/pages/api/event-type-custom-inputs/[id].ts
index 5ff11ff884..4df7114cef 100644
--- a/pages/api/event-type-custom-inputs/[id].ts
+++ b/pages/api/event-type-custom-inputs/[id].ts
@@ -102,7 +102,9 @@ async function eventTypeById(req: NextApiRequest, res: NextApiResponse<EventType
   const userEventTypeCustomInputIds = userEventTypeCustomInputs.map(
     (eventTypeCustomInput) => eventTypeCustomInput.id
   );
-  if (userEventTypeCustomInputIds.includes(safeQuery.data.id)) {
+  if (!userEventTypeCustomInputIds.includes(safeQuery.data.id))
+    res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.eventTypeCustomInput
@@ -155,7 +157,7 @@ async function eventTypeById(req: NextApiRequest, res: NextApiResponse<EventType
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(eventTypeById));
diff --git a/pages/api/event-types/[id].ts b/pages/api/event-types/[id].ts
index 80d4f95bb6..94dd09dee2 100644
--- a/pages/api/event-types/[id].ts
+++ b/pages/api/event-types/[id].ts
@@ -99,7 +99,8 @@ export async function eventTypeById(req: NextApiRequest, res: NextApiResponse<Ev
   const userId = req.userId;
   const data = await prisma.eventType.findMany({ where: { userId } });
   const userEventTypes = data.map((eventType) => eventType.id);
-  if (userEventTypes.includes(safeQuery.data.id)) {
+  if (!userEventTypes.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.eventType
diff --git a/pages/api/memberships/[id].ts b/pages/api/memberships/[id].ts
index 4c90122f70..acb8f03c0c 100644
--- a/pages/api/memberships/[id].ts
+++ b/pages/api/memberships/[id].ts
@@ -108,7 +108,8 @@ export async function membershipById(req: NextApiRequest, res: NextApiResponse<M
   // This is how we set the userId and teamId in the query for managing compoundId.
   const [paramUserId, teamId] = safeQuery.data.id.split("_");
   const userId = req.userId;
-  if (parseInt(paramUserId) === userId) {
+  if (parseInt(paramUserId) !== userId) res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.membership
@@ -181,7 +182,7 @@ export async function membershipById(req: NextApiRequest, res: NextApiResponse<M
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdString(membershipById));
diff --git a/pages/api/payments/[id].ts b/pages/api/payments/[id].ts
index 9d7d28a184..3f23750b2a 100644
--- a/pages/api/payments/[id].ts
+++ b/pages/api/payments/[id].ts
@@ -48,10 +48,10 @@ export async function paymentById(req: NextApiRequest, res: NextApiResponse<Paym
       .findUnique({ where: { id: safeQuery.data.id } })
       .then((data) => schemaPaymentPublic.parse(data))
       .then((payment) => {
-        if (userWithBookings?.bookings.map((b) => b.id).includes(payment.bookingId)) {
-          res.status(200).json({ payment });
-        } else {
+        if (!userWithBookings?.bookings.map((b) => b.id).includes(payment.bookingId)) {
           res.status(401).json({ message: "Unauthorized" });
+        } else {
+          res.status(200).json({ payment });
         }
       })
       .catch((error: Error) =>
diff --git a/pages/api/schedules/[id].ts b/pages/api/schedules/[id].ts
index e0b83f106b..a8fa501412 100644
--- a/pages/api/schedules/[id].ts
+++ b/pages/api/schedules/[id].ts
@@ -93,7 +93,8 @@ export async function scheduleById(req: NextApiRequest, res: NextApiResponse<Sch
   const userId = req.userId;
   const userSchedules = await prisma.schedule.findMany({ where: { userId } });
   const userScheduleIds = userSchedules.map((schedule) => schedule.id);
-  if (userScheduleIds.includes(safeQuery.data.id)) {
+  if (!userScheduleIds.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.schedule
@@ -144,7 +145,7 @@ export async function scheduleById(req: NextApiRequest, res: NextApiResponse<Sch
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(scheduleById));
diff --git a/pages/api/selected-calendars/[id].ts b/pages/api/selected-calendars/[id].ts
index c2febd9c47..5c00b3895f 100644
--- a/pages/api/selected-calendars/[id].ts
+++ b/pages/api/selected-calendars/[id].ts
@@ -132,7 +132,8 @@ export async function selectedCalendarById(
   // This is how we set the userId and externalId in the query for managing compoundId.
   const [paramUserId, integration, externalId] = safeQuery.data.id.split("_");
   const userId = req.userId;
-  if (userId === parseInt(paramUserId)) {
+  if (userId !== parseInt(paramUserId)) res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.selectedCalendar
@@ -208,7 +209,7 @@ export async function selectedCalendarById(
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdString(selectedCalendarById));
diff --git a/pages/api/teams/[id].ts b/pages/api/teams/[id].ts
index 69a3a7091f..f74937ecc5 100644
--- a/pages/api/teams/[id].ts
+++ b/pages/api/teams/[id].ts
@@ -97,7 +97,8 @@ export async function teamById(req: NextApiRequest, res: NextApiResponse<TeamRes
   //FIXME: This is a hack to get the teamId from the user's membership
   console.log(userWithMemberships);
   const userTeamIds = userWithMemberships.map((membership) => membership.teamId);
-  if (userTeamIds.includes(safeQuery.data.id)) {
+  if (!userTeamIds.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" });
+  else {
     switch (method) {
       case "GET":
         await prisma.team
@@ -148,7 +149,7 @@ export async function teamById(req: NextApiRequest, res: NextApiResponse<TeamRes
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(teamById));
diff --git a/pages/api/users/[id].ts b/pages/api/users/[id].ts
index 6dd4eb5f63..e1a11b3004 100644
--- a/pages/api/users/[id].ts
+++ b/pages/api/users/[id].ts
@@ -91,7 +91,8 @@ export async function userById(req: NextApiRequest, res: NextApiResponse<UserRes
   const safeBody = schemaUserBodyParams.safeParse(body);
   if (!safeQuery.success) throw new Error("Invalid request query", safeQuery.error);
   const userId = req.userId;
-  if (safeQuery.data.id === userId) {
+  if (safeQuery.data.id !== userId) res.status(401).json({ message: "Unauthorized" }); 
+  else {
     switch (method) {
       case "GET":
         await prisma.user
@@ -132,7 +133,7 @@ export async function userById(req: NextApiRequest, res: NextApiResponse<UserRes
         res.status(405).json({ message: "Method not allowed" });
         break;
     }
-  } else res.status(401).json({ message: "Unauthorized" });
+  }
 }
 
 export default withMiddleware("HTTP_GET_DELETE_PATCH")(withValidQueryIdTransformParseInt(userById));