Iterola API 1.0.0
Public REST API for Iterola. Authenticate with an API key created in the Iterola dashboard: send the base64-encoded key secret with HTTP Basic auth. Each key carries per-resource scopes like appointments:read or clients:write.
Base URL https://api.iterola.com
apiKey — HTTP Basic auth carrying only the API key secret: Authorization: Basic base64(<key secret>).accessToken — Operator session token issued by the Iterola dashboard: Authorization: Token <access token>.
Download the OpenAPI specification
Appointments
GET/api/appointments
List appointments
Lists the appointments of your organization. Requires the appointments:read scope. Optionally filter by businessId, clientId and a startTime/endTime window.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
businessId |
query |
string |
|
clientId |
query |
string |
|
startTime |
query |
string |
|
endTime |
query |
string |
|
limit |
query |
integer default 0 |
|
skip |
query |
integer default 0 |
|
sortField |
query |
string |
|
sortDirection |
query |
string ASC | DESC |
|
fields |
query |
string |
Comma-separated projection of fields to return |
Responses
| Status | Meaning |
|---|
200 | Array of appointments |
401 | Missing or invalid credentials |
403 | API key is missing the appointments:read scope |
429 | API key rate limit exceeded |
POST/api/appointments
Create an appointment
Creates an appointment. Requires the appointments:write scope. Fires the appointment.created webhook.
Authentication apiKey accessToken
Responses
| Status | Meaning |
|---|
200 | The created appointment |
GET/api/appointments/{appointmentId}
Get an appointment
Returns a single appointment by id. Appointments belonging to another organization respond 404. Requires the appointments:read scope.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
appointmentId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The appointment |
404 | Not found (or owned by another organization) |
PUT/api/appointments/{appointmentId}
Update an appointment
Updates an appointment. Requires the appointments:write scope. Appointments owned by another organization respond 404. Fires the appointment.updated webhook.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
appointmentId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The updated appointment |
404 | Not found (or owned by another organization) |
DELETE/api/appointments/{appointmentId}
Delete an appointment
Deletes an appointment by id. Requires the appointments:write scope. Appointments owned by another organization respond 404. Fires the appointment.deleted webhook.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
appointmentId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The deleted appointment id |
404 | Not found (or owned by another organization) |
Businesses
GET/api/businesses
List businesses
Lists the businesses in the authenticated organization. Requires the businesses:read scope when authenticating with an API key.
Authentication apiKey accessToken
Responses
| Status | Meaning |
|---|
200 | Array of businesses |
401 | Missing or invalid credentials |
403 | API key is missing the businesses:read scope |
429 | API key rate limit exceeded |
POST/api/businesses
Create a business
Authentication accessToken
Request body application/json
| Field | Type | Description |
|---|
name required |
string |
|
enabledApps required |
array |
|
Responses
| Status | Meaning |
|---|
201 | Business created |
400 | Invalid name or enabledApps |
409 | Domain is already taken |
GET/api/businesses/{businessId}
Get a business
Returns a business by id. A business in another organization is reported as not found. Requires the businesses:read scope when authenticating with an API key.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
businessId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The business |
404 | Not found or owned by another organization |
PUT/api/businesses/{businessId}
Update a business
Authentication accessToken
Parameters
| Name | In | Type | Description |
|---|
businessId required |
path |
string |
|
Request body application/json
| Field | Type | Description |
|---|
name required |
string |
|
enabledApps |
array |
|
Responses
| Status | Meaning |
|---|
200 | Business updated |
404 | Not found or owned by another organization |
DELETE/api/businesses/{businessId}
Delete a business
Authentication accessToken
Parameters
| Name | In | Type | Description |
|---|
businessId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | Business deleted |
404 | Not found or owned by another organization |
PUT/api/businesses/{businessId}/logo
Upload a business logo
Authentication accessToken
Parameters
| Name | In | Type | Description |
|---|
businessId required |
path |
string |
|
Request body application/json
| Field | Type | Description |
|---|
file required |
string |
Data URL or supported image input |
Responses
| Status | Meaning |
|---|
200 | Business with the uploaded logo |
404 | Not found or owned by another organization |
Clients
GET/api/clients
List clients
Lists the clients of your organization. Requires the clients:read scope. Optionally filter by businessId, _id, _ids, email or userId, and bound the result with limit/skip.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
businessId |
query |
string |
|
email |
query |
string |
|
fields |
query |
string |
Comma-separated projection of fields to return |
limit |
query |
integer default 0 |
|
skip |
query |
integer default 0 |
|
Responses
| Status | Meaning |
|---|
200 | Array of clients |
401 | Missing or invalid credentials |
403 | API key is missing the clients:read scope |
429 | API key rate limit exceeded |
POST/api/clients
Create a client
Creates a client. Requires the clients:write scope. Fires the client.created webhook.
Authentication apiKey accessToken
Responses
| Status | Meaning |
|---|
200 | The created client |
GET/api/clients/{clientId}
Get a client
Returns a single client by id. Clients belonging to another organization respond 404. Requires the clients:read scope.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
clientId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The client |
404 | Not found (or owned by another organization) |
PUT/api/clients/{clientId}
Update a client
Updates a client. Requires the clients:write scope. Clients owned by another organization respond 404. Fires the client.updated webhook.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
clientId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The updated client |
404 | Not found (or owned by another organization) |
DELETE/api/clients/{clientId}
Delete a client
Deletes a client by id. Requires the clients:write scope. Clients owned by another organization respond 404.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
clientId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The deleted client id |
404 | Not found (or owned by another organization) |
Keys
GET/api/keys
List API keys
Lists the API keys of your organization. The signing secret is never included — it is returned only once, in the create response. Managed with an operator access token, not an API key.
Authentication accessToken
Parameters
| Name | In | Type | Description |
|---|
fields |
query |
string |
Comma-separated projection of fields to return |
Responses
| Status | Meaning |
|---|
200 | Array of keys (without secrets) |
Services
GET/api/services
List services
Lists the services of your organization. Requires the services:read scope. Optionally filter by businessId.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
businessId |
query |
string |
|
fields |
query |
string |
Comma-separated projection of fields to return |
Responses
| Status | Meaning |
|---|
200 | Array of services |
401 | Missing or invalid credentials |
403 | API key is missing the services:read scope |
429 | API key rate limit exceeded |
POST/api/services
Create a service
Creates a service. Requires the services:write scope. Fires the service.created webhook.
Authentication apiKey accessToken
Responses
| Status | Meaning |
|---|
200 | The created service |
GET/api/services/{serviceId}
Get a service
Returns a single service by id. Services belonging to another organization respond 404. Requires the services:read scope.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
serviceId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The service |
404 | Not found (or owned by another organization) |
PUT/api/services/{serviceId}
Update a service
Updates a service. Requires the services:write scope. Services owned by another organization respond 404. Fires the service.updated webhook.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
serviceId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The updated service |
404 | Not found (or owned by another organization) |
DELETE/api/services/{serviceId}
Delete a service
Deletes a service by id. Requires the services:write scope. Services owned by another organization respond 404.
Authentication apiKey accessToken
Parameters
| Name | In | Type | Description |
|---|
serviceId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The deleted service id |
404 | Not found (or owned by another organization) |
Webhook subscriptions
GET/api/webhooksubscriptions
List webhook subscriptions
Webhook subscriptions deliver appointment.created, appointment.updated, appointment.deleted, client.created, client.updated, service.created and service.updated events to your server as signed POST requests (X-Iterola-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.
Authentication accessToken
Responses
| Status | Meaning |
|---|
200 | Array of webhook subscriptions (without secrets) |
POST/api/webhooksubscriptions
Create a webhook subscription
The response includes the signing secret exactly once — store it; it cannot be retrieved again.
Authentication accessToken
Request body application/json
| Field | Type | Description |
|---|
businessId required |
string |
|
url required |
string |
|
events |
array |
Empty array subscribes to all events |
Responses
| Status | Meaning |
|---|
200 | The created subscription, including its secret |
PUT/api/webhooksubscriptions/{webhookSubscriptionId}
Update a webhook subscription
url, events and active are editable; the secret and business are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.
Authentication accessToken
Parameters
| Name | In | Type | Description |
|---|
webhookSubscriptionId required |
path |
string |
|
Responses
| Status | Meaning |
|---|
200 | The updated subscription (without secret) |
DELETE/api/webhooksubscriptions/{webhookSubscriptionId}
Delete a webhook subscription
Authentication accessToken
Parameters
| Name | In | Type | Description |
|---|
webhookSubscriptionId required |
path |
string |
|
Responses