HairDora API reference

Every endpoint of the HairDora REST API, generated from the API itself.

All endpoints are relative to https://api.hairdora.com. Create an API key in your HairDora dashboard, then authenticate every request with it.

apiKey — HTTP Basic auth carrying only the API key secret: Authorization: Basic base64(<key secret>).

accessToken — Operator session token issued by the HairDora dashboard: Authorization: Token <access token>.

Download the OpenAPI specification for use with your own tooling.

Appointments

GET/api/appointments

List appointments

Lists the appointments of your organization. Requires the appointments:read scope. Optionally filter by salonId, clientId and a startTime/endTime window.

appointments:readapiKeyaccessToken

Parameters

Name	In	Type	Description
salonId	query	string
clientId	query	string
startTime	query	string
endTime	query	string
limit	query	integer
skip	query	integer
sortField	query	string
sortDirection	query	string (ASC \| DESC)
fields	query	string	Comma-separated projection of fields to return

Responses

Status	Meaning
200	Array of appointments
401	Missing or invalid credentials
403	API key is missing the appointments:read scope
429	API key rate limit exceeded

POST/api/appointments

Create an appointment

Creates an appointment. Requires the appointments:write scope. Fires the appointment.created webhook.

appointments:writeapiKeyaccessToken

Responses

Status	Meaning
200	The created appointment

GET/api/appointments/{appointmentId}

Get an appointment

Returns a single appointment by id. Appointments belonging to another organization respond 404. Requires the appointments:read scope.

appointments:readapiKeyaccessToken

Parameters

Name	In	Type	Description
appointmentIdrequired	path	string

Responses

Status	Meaning
200	The appointment
404	Not found (or owned by another organization)

PUT/api/appointments/{appointmentId}

Update an appointment

Updates an appointment. Requires the appointments:write scope. Appointments owned by another organization respond 404. Fires the appointment.updated webhook.

appointments:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
appointmentIdrequired	path	string

Responses

Status	Meaning
200	The updated appointment
404	Not found (or owned by another organization)

DELETE/api/appointments/{appointmentId}

Delete an appointment

Deletes an appointment by id. Requires the appointments:write scope. Appointments owned by another organization respond 404. Fires the appointment.deleted webhook.

appointments:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
appointmentIdrequired	path	string

Responses

Status	Meaning
200	The deleted appointment id
404	Not found (or owned by another organization)

Clients

GET/api/clients

List clients

Lists the clients of your organization. Requires the clients:read scope. Optionally filter by salonId, _id, _ids, email or userId, and bound the result with limit/skip.

clients:readapiKeyaccessToken

Parameters

Name	In	Type	Description
salonId	query	string
email	query	string
fields	query	string	Comma-separated projection of fields to return
limit	query	integer
skip	query	integer

Responses

Status	Meaning
200	Array of clients
401	Missing or invalid credentials
403	API key is missing the clients:read scope
429	API key rate limit exceeded

POST/api/clients

Create a client

Creates a client. Requires the clients:write scope. Fires the client.created webhook.

clients:writeapiKeyaccessToken

Responses

Status	Meaning
200	The created client

GET/api/clients/{clientId}

Get a client

Returns a single client by id. Clients belonging to another organization respond 404. Requires the clients:read scope.

clients:readapiKeyaccessToken

Parameters

Name	In	Type	Description
clientIdrequired	path	string

Responses

Status	Meaning
200	The client
404	Not found (or owned by another organization)

PUT/api/clients/{clientId}

Update a client

Updates a client. Requires the clients:write scope. Clients owned by another organization respond 404. Fires the client.updated webhook.

clients:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
clientIdrequired	path	string

Responses

Status	Meaning
200	The updated client
404	Not found (or owned by another organization)

DELETE/api/clients/{clientId}

Delete a client

Deletes a client by id. Requires the clients:write scope. Clients owned by another organization respond 404.

clients:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
clientIdrequired	path	string

Responses

Status	Meaning
200	The deleted client id
404	Not found (or owned by another organization)

Keys

GET/api/keys

List API keys

Lists the API keys of your organization. The signing secret is never included — it is returned only once, in the create response. Managed with an operator access token, not an API key.

accessToken

Parameters

Name	In	Type	Description
fields	query	string	Comma-separated projection of fields to return

Responses

Status	Meaning
200	Array of keys (without secrets)

Salons

GET/api/salons

List salons

Lists the salons of your organization. Requires the salons:read scope.

salons:readapiKeyaccessToken

Responses

Status	Meaning
200	Array of salons
401	Missing or invalid credentials
403	API key is missing the salons:read scope
429	API key rate limit exceeded

GET/api/salons/{salonId}

Get a salon

Returns a single salon by id. Salons belonging to another organization respond 404. Requires the salons:read scope.

salons:readapiKeyaccessToken

Parameters

Name	In	Type	Description
salonIdrequired	path	string

Responses

Status	Meaning
200	The salon
404	Not found (or owned by another organization)

Services

GET/api/services

List services

Lists the services of your organization. Requires the services:read scope. Optionally filter by salonId.

services:readapiKeyaccessToken

Parameters

Name	In	Type	Description
salonId	query	string
fields	query	string	Comma-separated projection of fields to return

Responses

Status	Meaning
200	Array of services
401	Missing or invalid credentials
403	API key is missing the services:read scope
429	API key rate limit exceeded

POST/api/services

Create a service

Creates a service. Requires the services:write scope. Fires the service.created webhook.

services:writeapiKeyaccessToken

Responses

Status	Meaning
200	The created service

GET/api/services/{serviceId}

Get a service

Returns a single service by id. Services belonging to another organization respond 404. Requires the services:read scope.

services:readapiKeyaccessToken

Parameters

Name	In	Type	Description
serviceIdrequired	path	string

Responses

Status	Meaning
200	The service
404	Not found (or owned by another organization)

PUT/api/services/{serviceId}

Update a service

Updates a service. Requires the services:write scope. Services owned by another organization respond 404. Fires the service.updated webhook.

services:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
serviceIdrequired	path	string

Responses

Status	Meaning
200	The updated service
404	Not found (or owned by another organization)

DELETE/api/services/{serviceId}

Delete a service

Deletes a service by id. Requires the services:write scope. Services owned by another organization respond 404.

services:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
serviceIdrequired	path	string

Responses

Status	Meaning
200	The deleted service id
404	Not found (or owned by another organization)

Webhook subscriptions

GET/api/webhooksubscriptions

List webhook subscriptions

Webhook subscriptions deliver appointment.created, appointment.updated, appointment.deleted, client.created, client.updated, service.created and service.updated events to your server as signed POST requests (X-Hairdora-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.

accessToken

Responses

Status	Meaning
200	Array of webhook subscriptions (without secrets)

POST/api/webhooksubscriptions

Create a webhook subscription

The response includes the signing secret exactly once — store it; it cannot be retrieved again.

accessToken

Request body

Field	Type	Description
salonIdrequired	string
urlrequired	string
events	array (appointment.created \| appointment.updated \| appointment.deleted \| client.created \| client.updated \| service.created \| service.updated)	Empty array subscribes to all events

Responses

Status	Meaning
200	The created subscription, including its secret

PUT/api/webhooksubscriptions/{webhookSubscriptionId}

Update a webhook subscription

url, events and active are editable; the secret and salon are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.

accessToken

Parameters

Name	In	Type	Description
webhookSubscriptionIdrequired	path	string

Responses

Status	Meaning
200	The updated subscription (without secret)

DELETE/api/webhooksubscriptions/{webhookSubscriptionId}

Delete a webhook subscription

accessToken

Parameters

Name	In	Type	Description
webhookSubscriptionIdrequired	path	string

Responses

Status	Meaning
200	Deleted

HairDora API reference

Appointments

Clients

Keys

Salons

Services

Webhook subscriptions

Language

Resources

Free tools

Follow Us

Contact us