API & Webhooks — Amplifa Booking

Authentifizierung

Alle Endpoints (außer /health und /events) erwarten einen API-Key im Authorization-Header. Lege Keys in deinem Workspace unter API-Keys an.

Authorization: Bearer ak_live_xxxxxxxxxxxxxxxxxxxxxxxx

Scopes: read, write, admin. Ein Key mit admin deckt automatisch alle anderen Scopes ab.

Base-URL & Fehler

Base-URL:

https://www.amplifabooking.com/api/public/v1

Rate-Limit: 60 Anfragen pro Minute pro Key. Fehlerformat:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API key."
  }
}

Status-Codes: 200/201 ok · 400 invalid_input · 401 unauthorized · 403 forbidden · 404 not_found · 429 rate_limited · 500 internal.

Health & Me

GET/healthScope: —

curl https://www.amplifabooking.com/api/public/v1/health

GET/meScope: read

Gibt deinen Workspace und Scope-Info des Keys zurück.

curl https://www.amplifabooking.com/api/public/v1/me \
  -H "Authorization: Bearer ak_live_..."

Event Types

GET/event-typesScope: read

Optionale Query-Parameter: user_id, active=true|false.

curl "https://www.amplifabooking.com/api/public/v1/event-types?active=true" \
  -H "Authorization: Bearer ak_live_..."

GET/event-types/{id}Scope: read

POST/event-typesScope: write

Body (Pflichtfelder: title, duration_min):

{
  "title": "30 Minute Discovery",
  "duration_min": 30,
  "slug": "discovery",
  "description": "Kurzes Erstgespräch",
  "user_id": "uuid-of-host",
  "meeting_provider": "google_meet",
  "requires_confirmation": false
}

PATCH/event-types/{id}Scope: write

DELETE/event-types/{id}Scope: write

Bookings

GET/bookingsScope: read

Query: status (confirmed/cancelled), from, to, event_type_id, limit (max 200).

curl "https://www.amplifabooking.com/api/public/v1/bookings?status=confirmed&from=2026-06-01T00:00:00Z" \
  -H "Authorization: Bearer ak_live_..."

GET/bookings/{id}Scope: read

POST/bookings/{id}/cancelScope: write

Storniert die Buchung, löscht das Kalender-Event und feuert booking.cancelled.

curl -X POST https://www.amplifabooking.com/api/public/v1/bookings/uuid/cancel \
  -H "Authorization: Bearer ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{"reason": "Verschoben auf Q3"}'

Verfügbarkeit

GET/availability/slotsScope: read

Berechnet freie Slots für einen Event-Typ. Query: event_type_id, from, to, optional timezone.

curl "https://www.amplifabooking.com/api/public/v1/availability/slots?event_type_id=uuid&from=2026-06-20T00:00:00Z&to=2026-06-27T00:00:00Z&timezone=Europe/Berlin" \
  -H "Authorization: Bearer ak_live_..."

Webhooks (per API verwalten)

GET/webhooksScope: read

POST/webhooksScope: admin

Erstellt einen Webhook. Antwort enthält das frisch generierte secret einmalig im Klartext.

{
  "url": "https://hooks.zapier.com/...",
  "events": ["booking.created", "booking.cancelled"],
  "description": "Zapier"
}

PATCH/webhooks/{id}Scope: admin

DELETE/webhooks/{id}Scope: admin

Webhook-Events

Outgoing-Webhooks werden mit HMAC-SHA256 über dem Raw-Body signiert. Header:

x-amplifa-signature: <hex-digest>
x-amplifa-event: booking.created

Verifikation in Node:

import crypto from "node:crypto";

function verify(rawBody, signature, secret) {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected); const b = Buffer.from(signature);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Verfügbare Events: booking.created, booking.cancelled, booking.rescheduled. Volle Liste & Beispiel-Payloads:

curl https://www.amplifabooking.com/api/public/v1/events

Amplifa Booking API