Developer Documentation

LemCall API & Integrations

The public REST API, webhooks and embeds — documented against what the platform actually implements today.

Authentication

The public API is authenticated with a LemCall API key. There is no public anonymous-key or end-user JWT contract.

Base URL

https://api.lemcall.co/v1

The branded API domain is being provisioned. Until DNS is live, ask your workspace admin for the current API host — the paths, authentication and payloads below are unchanged.

Request header

Authorization: Bearer lcsk_<prefix>_<secret>
Content-Type: application/json

Key types

Personal keys act as the user who created them. Service keys belong to a workspace and are intended for server-to-server automation. Both use the same lcsk_ format and are stored only as a SHA-256 hash — the secret is shown once at creation and cannot be recovered.

Expiry and revocation

A key can be given an expiry date; requests after it return expired_api_key. Revoking a key in Workspace → Developers takes effect immediately and returns revoked_api_key. Every request is recorded (method, path, status, duration) and the key's last_used_at is updated. Key rotation is not yet available — revoke and create a new key.

Scopes

Each key carries an explicit scope list. Missing scopes return 403.

bookings:read

List and read bookings owned by the key's workspace user

bookings:write

Cancel bookings. Booking creation is currently unavailable.

event_types:read

List meeting types owned by the key's workspace user

Endpoints

All responses are JSON: { "data": … } or { "error": … }.

GET /event-types

List your meeting types

event_types:read

GET /bookings

List bookings. Filters: from, to, status, limit (max 200)

bookings:read

GET /bookings/{id}

Fetch a single booking

bookings:read

DELETE /bookings/{id}

Cancel a booking

bookings:write

POST /bookings

Create a booking — currently disabled (501)

bookings:write

Example request

curl "https://api.lemcall.co/v1/bookings?from=2026-08-01T00:00:00Z&limit=50" \
  -H "Authorization: Bearer lcsk_ab12cd34_your_secret_here"

Example response

{
  "data": [
    {
      "id": "b6c1…",
      "confirmation_number": "LC-A1B2C3D4",
      "full_name": "John Doe",
      "email": "john@example.com",
      "service": "Discovery Call",
      "status": "confirmed",
      "start_at": "2026-08-04T09:00:00Z",
      "end_at": "2026-08-04T09:30:00Z",
      "timezone": "Europe/London",
      "event_type_id": "e91f…",
      "payment_status": null,
      "created_at": "2026-08-01T12:04:11Z"
    }
  ]
}

Booking creation is currently unavailable

POST /bookings returns HTTP 501 while it is migrated onto the same booking service the public booking pages use.

HTTP/1.1 501 Not Implemented

{
  "error": "feature_unavailable",
  "code": "booking_create_disabled",
  "message": "Creating bookings through the API is temporarily unavailable."
}

When it returns, creation will require an Idempotency-Key header: retrying the same key returns the original booking instead of creating a second one. Until then, use a booking page, an embed, or the direct link to create bookings so availability, conflict, routing and notification guarantees are applied.

Error responses

missing_or_malformed_api_key

No `Authorization: Bearer lcsk_…` header

401

invalid_api_key

The key does not exist

401

revoked_api_key

The key was revoked in the dashboard

401

expired_api_key

The key passed its expiry date

401

insufficient_scope

The key lacks the scope required by the route

403

not_found

Unknown route, or the record is not in your workspace

404

feature_unavailable

Endpoint temporarily disabled (see POST /bookings)

501

internal_error

Unexpected server error — safe to retry

500

Webhook Events

Configure webhooks in Workspace → Developers to receive real-time notifications.

booking.created

Fired when a new booking is confirmed

POST

booking.cancelled

Fired when a booking is cancelled

POST

booking.rescheduled

Fired when a booking is rescheduled

POST

booking.completed

Fired when a booking is marked completed

POST

booking.reminder

Fired when a reminder is sent

POST

Example Payload

{
  "event": "booking.created",
  "data": {
    "id": "uuid",
    "full_name": "John Doe",
    "email": "john@example.com",
    "service": "Discovery Call",
    "start_at": "2026-08-04T09:00:00Z",
    "end_at": "2026-08-04T09:30:00Z",
    "status": "confirmed",
    "confirmation_number": "LC-A1B2C3D4"
  }
}

Embedding Options

Add booking functionality directly to your website

Inline Embed

Embed your booking page directly in your website using an iframe

<iframe src="https://lemcall.co/book?widget=YOUR_WIDGET_ID" style="width:100%;height:700px;border:none;border-radius:8px;" title="Book an appointment"></iframe>

Direct Link

Link directly to your booking page

<a href="https://lemcall.co/book" target="_blank">Book a Meeting</a>

The floating-widget script snippet is generated for you, with your widget ID already filled in, in Workspace → Embed.

Limits & Best Practices

Rate limits: per-key request limits are not yet enforced on the REST API. Keep sustained traffic modest and back off on 5xx responses; every request is logged per key.

Timezones: all timestamps are UTC ISO 8601. The timezone field is the booker's display zone.

Workspace isolation: a key only ever sees records owned by its workspace user. Unknown IDs return 404, never another workspace's data.

Webhooks: payloads include a signature header for verification. Retry policy: 3 attempts with exponential backoff.