Build on magtyne cadence.

All requests go over HTTPS to the versioned base below. We never break a version in place; new fields are additive, and breaking changes ship under a new version prefix.

https://book.magtyne.com/api/v1

Send and expect application/json. All timestamps are ISO 8601 UTC; show them in the recipient's time zone in your UI.

Create a key under Integrations, Developer. It is shown once, so store it in a secret manager. Send it as a bearer token on every request; keys are scoped to a single workspace.

curl https://book.magtyne.com/api/v1/bookings \
  -H "Authorization: Bearer mk_live_your_key_here" \
  -H "Content-Type: application/json"

Rotate a key anytime; revoking it takes effect immediately. Never expose a key in client-side code.

The core resources. List endpoints accept ?limit= (max 100).

Query parameters for GET /v1/bookings

curl -X POST https://book.magtyne.com/api/v1/bookings \
  -H "Authorization: Bearer mk_live_..." -H "Content-Type: application/json" \
  -d '{
    "eventType": "intro-call",
    "start": "2026-06-25T15:30:00Z",
    "invitee": { "name": "Emily Carter", "email": "emily@example.com" }
  }'

Errors return the right HTTP status and a JSON body with a stable code and a human message. Branch on code, not the message.

Add an endpoint under Integrations, Developer. We POST a signed JSON payload the moment something happens. Each delivery carries an X-Cadence-Signature header (t=<unix>,v1=<hmac>); verify it with your endpoint secret before trusting the request.

Verify the signature (Node)

import crypto from 'node:crypto';

function verify(rawBody, header, secret) {
  const [t, sig] = header.split(',').map((p) => p.split('=')[1]);
  const expected = crypto.createHmac('sha256', secret)
    .update(`${t}.${rawBody}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

Example payload

{
  "event": "booking.created",
  "createdAt": "2026-06-23T14:05:00.000Z",
  "data": {
    "id": "bk_8f2c...",
    "eventType": "intro-call",
    "start": "2026-06-25T15:30:00.000Z",
    "invitee": { "name": "Emily Carter", "email": "emily@example.com" }
  }
}

A retried POST /v1/bookings cannot double-book: a taken slot returns 409 conflict, so treat 409 as "already done" when retrying. Failed webhook deliveries are retried three times with backoff; make your handler idempotent by keying on the booking id in the payload.

API requests are limited to 120 per minute per key. Over the limit, a request returns 429 with the rate_limited code and a Retry-After header; back off and retry with jitter. For sustained high-volume use, talk to us about your workload.