Private-beta booking API.

The BookBridge API gives approved clients a normalized way to read business booking data, search availability, request appointment changes, confirm customer consent, and track fulfillment.

Core flow

1. Read the business profile, locations, and services.
2. Search availability for the selected service and date range.
3. Submit a booking, reschedule, or cancellation request with an idempotency key.
4. If the API returns confirmation_required, show the summary to the customer.
5. Confirm the consent record, then resubmit the original write.
6. Track appointment or fulfillment status until booked, proposed, failed, or escalated for review.

Representative endpoints

Public onboarding and health

• GET /health
• GET /health/ready
• POST /v1/onboarding/analyze
• POST /v1/onboarding/signup

Business reads

• GET /v1/businesses/:organizationId/profile
• GET /v1/businesses/:organizationId/locations
• GET /v1/businesses/:organizationId/services
• POST /v1/availability/search

Appointment writes

• POST /v1/appointments
• POST /v1/appointments/:appointmentId/reschedule
• POST /v1/appointments/:appointmentId/cancel
• GET /v1/appointments/:appointmentId/status

Write requests require an Idempotency-Key header and explicit customer confirmation before completion.

Consent

• GET /v1/consent/:id
• POST /v1/consent/:id/confirm

Fulfillment

• POST /v1/book-local for platform/local natural-language examples
• GET /v1/fulfillment/:jobId
• POST /v1/fulfillment/:jobId/accept
• POST /v1/fulfillment/:jobId/decline

Hosted company MCP

Approved companies can create a tenant-bound hosted MCP endpoint at /mcp/:companySlug. The hosted company endpoint exposes company-specific tools according to the credential scopes. Broader tools such as find_local_business and book_local_appointment are platform/local MCP examples, not the default tool list for every hosted company endpoint.

Private-beta boundaries

• Human healthcare scheduling is not supported.
• Browser, voice, and human-assisted rails require private-beta approval and review.
• Do not put bearer credentials in public website JavaScript.
• Use a company-MCP credential only with its company-specific MCP endpoint; platform API credentials are rejected there.
• Rotate dashboard-issued credentials before their 90-day expiry and revoke any credential that is no longer used.
• Exact scopes, quotas, and endpoint availability may change during private beta.