We're currently testing a Microsoft Graph API integration that works with the Calendar created in Bookings. We aren't running off the Bookings API as it is still in preview and lacks certain data points, but rather interfacing directly with the underlying calendar as it works and syncs properly with Bookings, as long as you stick to basic operation such as GETS and DELETES.
We ran into an odd scenario in which the Graph API returns a 204 NO CONTENT status on a failing DELETE request. The user being tested has REVIEWER folder permissions on the calendar. When a DELETE request goes out, the event does not delete (as intended with someone who only had REVIEWER permissions), however the response received is a 204 NO CONTENT response, which should only be returning upon a successful request according to the Graph API Documentation.
Sample:
//Signed in user is listed a REVIEWER on calendar
REQUEST: DELETE https://graph.microsoft.com/v1.0/users/{id}/events/{id}
RESPONSE: 204 NO CONTENT //Even though calendar event remains
Is this an issue with the Graph API or do I need to get permissions issues for failed requests another way? Seems wrong it would show successful for a failed request, but I know things may get weird working with the underlying calendar.