HairDora API 1.0.0

GET/api/appointments

List appointments

Lists the appointments of your organization. Requires the appointments:read scope. Optionally filter by salonId, clientId and a startTime/endTime window.

Parameters

Responses

POST/api/appointments

Create an appointment

Creates an appointment. Requires the appointments:write scope. Fires the appointment.created webhook.

Responses

GET/api/appointments/{appointmentId}

Get an appointment

Returns a single appointment by id. Appointments belonging to another organization respond 404. Requires the appointments:read scope.

Parameters

Responses

PUT/api/appointments/{appointmentId}

Update an appointment

Updates an appointment. Requires the appointments:write scope. Appointments owned by another organization respond 404. Fires the appointment.updated webhook.

Parameters

Request body application/json

Responses

DELETE/api/appointments/{appointmentId}

Delete an appointment

Deletes an appointment by id. Requires the appointments:write scope. Appointments owned by another organization respond 404. Fires the appointment.deleted webhook.

Parameters

Responses

GET/api/clients

List clients

Lists the clients of your organization. Requires the clients:read scope. Optionally filter by salonId, _id, _ids, email or userId, and bound the result with limit/skip.

Parameters

Responses

POST/api/clients

Create a client

Creates a client. Requires the clients:write scope. Fires the client.created webhook.

Responses

GET/api/clients/{clientId}

Get a client

Returns a single client by id. Clients belonging to another organization respond 404. Requires the clients:read scope.

Parameters

Responses

PUT/api/clients/{clientId}

Update a client

Updates a client. Requires the clients:write scope. Clients owned by another organization respond 404. Fires the client.updated webhook.

Parameters

Request body application/json

Responses

DELETE/api/clients/{clientId}

Delete a client

Deletes a client by id. Requires the clients:write scope. Clients owned by another organization respond 404.

Parameters

Responses

GET/api/keys

List API keys

Lists the API keys of your organization. The signing secret is never included — it is returned only once, in the create response. Managed with an operator access token, not an API key.

Parameters

Responses

GET/api/salons

List salons

Lists the salons of your organization. Requires the salons:read scope.

Responses

GET/api/salons/{salonId}

Get a salon

Returns a single salon by id. Readable anonymously, like the by-vanity-name lookup below. An authenticated caller still only sees a salon it owns: salons belonging to another organization respond 404. Requires the salons:read scope when called with an API key.

Parameters

Responses

GET/api/services

List services

Lists the services of your organization. Requires the services:read scope. Optionally filter by salonId.

Parameters

Responses

POST/api/services

Create a service

Creates a service. Requires the services:write scope. Fires the service.created webhook.

Responses

GET/api/services/{serviceId}

Get a service

Returns a single service by id. Services belonging to another organization respond 404. Requires the services:read scope.

Parameters

Responses

PUT/api/services/{serviceId}

Update a service

Updates a service. Requires the services:write scope. Services owned by another organization respond 404. Fires the service.updated webhook.

Parameters

Request body application/json

Responses

DELETE/api/services/{serviceId}

Delete a service

Deletes a service by id. Requires the services:write scope. Services owned by another organization respond 404.

Parameters

Responses

GET/api/webhooksubscriptions

List webhook subscriptions

Webhook subscriptions deliver appointment.created, appointment.updated, appointment.deleted, client.created, client.updated, service.created and service.updated events to your server as signed POST requests (X-Hairdora-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.

Responses

POST/api/webhooksubscriptions

Create a webhook subscription

The response includes the signing secret exactly once — store it; it cannot be retrieved again.

Request body application/json

Responses

PUT/api/webhooksubscriptions/{webhookSubscriptionId}

Update a webhook subscription

url, events and active are editable; the secret and salon are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.

Parameters

Responses

DELETE/api/webhooksubscriptions/{webhookSubscriptionId}

Delete a webhook subscription

Delete a webhook subscription

Parameters

Responses