Information
- License: Proprietary
- OpenAPI version:
3.1.0
Overview
Keptslot API 1
Section titled “ Keptslot API 1 ”Appointment booking for one workspace or many. Every endpoint uses an API key, except the customer-link routes under /v1/public, where the token in the path is the only credential.
Authentication
Section titled “ Authentication ”SecretKey
Section titled “ SecretKey ”A workspace secret key, prefix sk_. Use it from a server. Do not put
it in a browser.
Rate limited at 3000 requests a minute, shared by every secret key
the workspace holds (minting a second key does not grant fresh
capacity). This is an abuse backstop against a leaked key or a
runaway script, not metering – no legitimate integration should
ever approach it. See RateLimited.
Security scheme type: http
PublishableKey
Section titled “ PublishableKey ”A workspace publishable key, prefix pk_. Use it from a browser. It
reaches three endpoints only: GET /v1/availability, POST /v1/bookings
and POST /v1/bookings/{id}/verify. Every other route refuses it with a
403 and secret_key_required.
The API checks the Origin header when the request carries one. A request that sends no Origin is not origin-checked, so this key does work from a server. The origin list is an anti-abuse control and not a security boundary. See the keys guide.
Security scheme type: http
AccountKey
Section titled “ AccountKey ”An account key, prefix ak_. It reaches the four /v1/account routes
and no others. It does not unlock workspace routes. Use it from a
server.
Rate limited at 600 requests a minute, shared by the account’s total
request rate against these routes – across every account key and
every workspace the account holds, the same reasoning as SecretKey’s
ceiling. See RateLimited.
Security scheme type: http