A salon booking API for Canadian salons: keys, webhooks and your own tools
Your bookkeeper wants last month's appointments in a spreadsheet. Your newsletter tool wants new clients who agreed to hear from you. Your website wants to book straight into the diary. Slotora gives each of them a key that sees only what it needs, and sends a signed message to your tool whenever something changes. Zapier and Make work with it without a developer.
Get a key in a 14-day trialWhat Canadian salons connect
A bookkeeper's sheet
A read-only key that pulls appointments and what was paid, for the month-end reconciliation.
A mailing tool
New clients, with their marketing consent, so only the ones who said yes are added.
Your own website
Free times read live, and a booking made exactly the way the front desk makes one.
Zapier or Make
A webhook catches every new booking and passes it on to whatever your other tools are.
Three Canadian details the API already handles
Time zones. Every date comes back in your salon's own zone with its offset, and each booking names its zone. A salon in St. John's gets UTC−3:30, one in Regina gets the same offset all year because Saskatchewan does not change its clocks, and a spreadsheet shows the hour your diary shows, not the hour in London.
Consent for commercial email. Canada's anti-spam law asks a business to obtain consent before it sends commercial electronic messages. Each client in the API carries whether she has opted out and, where she gave it, when she agreed. A mailing tool connected to Slotora should send only to clients who agreed and have not opted out.
Where the data goes. A tool you give a key to receives client information from you, so choose it as carefully as any other provider that holds your clients' details. Our side is the same as for everything else in Slotora. Your salon's data is stored in a database in London, United Kingdom (Amazon Web Services, region eu-west-2), and the providers that send your emails and texts, take card payments and deliver app notifications process some of it in the United States.
The endpoints
JSON over HTTPS. Send the key as a Bearer token in the Authorization header, or as X-Api-Key; never in the address.
| Request | Permission | Answers with |
|---|---|---|
| GET /api/v1/me | Any | Your salon and what this key may do — the call for testing a connection |
| GET /api/v1/bookings | Read bookings | Appointments from today for 31 days, or between two dates; filter by status, team member or premises |
| GET /api/v1/availability | Read bookings | Free times for one service on one day |
| POST /api/v1/bookings | Make bookings | A booking at a time the salon offers, for a known client or a new one |
| GET /api/v1/clients | Read clients | The client book, filtered by created or updated since |
| GET /api/v1/services, /staff, /premises | Read services and team | Your menu, your people and your addresses |
Lists arrive a page at a time with a cursor. Each key may make 120 requests a minute; past that the answer is 429 with Retry-After.
Every new booking into a spreadsheet, with Zapier
About ten minutes, and no code.
01
Make a catch hook
In Zapier, start a Zap with Webhooks by Zapier as the trigger and Catch Hook as the event. Copy the address it gives you.
02
Paste it into Slotora
Settings, then API & webhooks, then Webhooks. Paste the address and tick booking.created.
03
Send a test
Press Send a test beside it. A sample booking with every field arrives in Zapier, with no real client's details in it.
04
Map the row
Add a Google Sheets action, choose your sheet, and match the fields: date, time, client, service, team member, price.
How webhooks behave
Five events can be sent: a booking made, changed or cancelled, a new client, and money recorded on a booking. Slotora looks for changes every quarter of an hour, so a message reaches your tool within about fifteen minutes. Each one is signed with a secret only you and Slotora hold, so your tool can check it really came from us.
If your tool does not answer, Slotora tries again after one minute, five, thirty, then two, six, twelve and twenty-four hours. After fifteen failures in a row the address is paused and the owner is told, so a broken connection never fails quietly for weeks.
What the API will not do
Deliberate limits, so a connected tool cannot do more harm than a person at your desk:
- Read private notes
- Client notes, booking notes and the caution field never leave Slotora, by any key.
- Book outside your rules
- A booking through the API must be a time the salon offers. Overrides stay with a person at the desk.
- Show hidden contacts
- If your team cannot see clients' phone numbers and emails, neither can a key; they come back empty and marked as hidden.
- Live in an app directory
- There is no Slotora app listed in Zapier or Make yet; you connect through their webhook and web-request steps.
Questions from developers and owners
Is the API part of the Canadian plan?
Yes. Keys, requests and webhooks are included; nothing is charged per call. The only limit is 120 requests a minute for each key.
Who can create a key?
The salon's owner or an admin, in the browser. A key is shown once; Slotora keeps only a fingerprint of it, so copy it straight into your tool.
Can a key make bookings?
Only if you tick Make bookings when you create it. The booking follows your hours, rooms and services, exactly like one made at the desk, and the client gets your usual email confirmation.
What time zone do dates come back in?
Your salon's own, with its offset, so a Halifax salon sees Atlantic time and a Vancouver salon Pacific time.
Can I see what a connected tool has been doing?
Yes. Every request a key makes is in the salon's request log, and every webhook delivery is in that address's delivery log.
Source
The consent rule above is summarised from this Government of Canada page, read on the day shown.
- Innovation, Science and Economic Development Canada — Canada's anti-spam legislation — https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en/canadas-anti-spam-legislation · Read on
Make your first key
Open the salon account, go to Settings and API & webhooks, and test the connection with one request. Everything on this page works during the trial.