The API lets you connect your account to other tools, automations and AI agents. This article covers who can use it, how to get your API key, how to use it and what it can reach.
Which plans include API access?
All of them. The API is available on every plan, including Newbie, and you do not need to be an approved partner or apply for access. Any business can create a key and start using it.
How to get your API key
Open Settings and scroll to the bottom of the sidebar, where you will find Developers under the Advanced heading
Click Developers, then API Keys
Click Add API key and give it a name
Copy the key it gives you
Each key is listed with its name, the key itself, its status and when it was last used, so you can see at a glance whether a key is active and whether anything is using it. Use the copy icon next to the key to copy it. The three dots at the end of the row open a menu with 3 options. Block stops the key being used, Edit Name renames it, and Delete removes it permanently.
Your key starts with sk_ followed by your own unique key. Store it somewhere safe. Treat it like a password, since anyone who has it can read and change your data through the API.
We recommend creating a separate key for each integration, and naming each one after what it is used for. That way, if you ever need to shut one down, because it has been shared by mistake or you have stopped using the tool, you can block that key without cutting off everything else you have connected. Block is the safer choice if you are not sure, since a deleted key is gone for good. The Last Used column also helps here, since a key that shows Never or has not been used for months is a good candidate to block.
The Developers section also has a Documentation link, which opens the full reference at developer.boothbook.com.
How to use your key
Send your key in the X-API-KEY header on every request. Your business is worked out from the key itself, so you never send a business ID in the path or the body.
If the header is missing or the key is not valid, the API answers with a 403 error.
Any agent or tool that can make API requests can work with your account once you give it your key. That includes AI agents, scripts, custom software and no-code tools.
What you can reach
Leads, contacts, venues, tasks, contracts, projects and vehicles can each be listed, fetched individually, created and updated. Each also has a fields endpoint that lists the fields on that record type, including the key for each one, which is what you use to read and write values.
Bookings can be listed and fetched but not created or updated. Transactions can be listed. Users, teams and your account details can be read, and users can be filtered by team or email.
The API does not delete records. Deleting is only available for webhook subscriptions, covered below.
Reading data
Lists come back newest first and are always paginated. Use limit to set how many records you want per page, which defaults to 50 and can go up to 200, and offset to skip records. Each response tells you the total number of matching records and whether there are more.
Each record is returned with its field values keyed by the field key, and leads and bookings also include their quotes, with line items, totals, what has been paid and the balance due.
Leads and bookings are kept separate. Anything under leads only returns unconfirmed jobs, and bookings only returns confirmed ones. Asking for a confirmed job under leads returns a 404.
Creating and updating records
To create or update a record, send a map of field keys and their values. The record you get back is in the same shape as a read, so you can post it back unchanged. Unknown field keys are rejected, and if there are several problems with what you sent, they are all reported at once.
A lead created through the API is always unconfirmed. If the status you send would confirm it, the API rejects the request with a 422, so confirming a lead still happens inside your account.
If you leave out the brand, the record uses your default brand.
Saving app data on a record
Apps and integrations can save their own data against a record, such as the photo template, start screen or backdrop a customer picked. Each entry is saved under a data type and an app, and sending the same data type again replaces it. You can list the data already saved on a record at any time.
Saving a template, start screen or backdrop also triggers the matching automation in your account, so you can follow up when a customer makes a choice.
Rate limits
You can make 500 requests per minute per IP address. Every response includes two headers so you can keep track, X-RateLimit-Limit and X-RateLimit-Remaining.
If you go over, the API answers with a 429 error until the minute is up. If you are pulling a lot of data, slow your requests down rather than retrying straight away.
Getting notified when something happens
Instead of asking the API for new data again and again, you can subscribe a URL to be notified when something happens. These are the events you can subscribe to:
Contacts: created, updated and deleted
Tasks: created, updated and deleted
Payments: created
Leads: deleted
Bookings: deleted
To subscribe, send your URL and the event you want. The response includes a signing secret that starts with whsec_. It is only shown once, so store it straight away. If you lose it, delete the subscription and create a new one.
When the event happens, we send a POST request to your URL with the event type, when it happened and the record itself. Every request is signed, and you should check the signature against your secret before trusting it, since your URL is the only thing someone would need to guess to send you fake events. Reply with any 2xx response as soon as you have it, and do your processing afterwards, because we wait 10 seconds for an answer.
Delivery is guaranteed at least once, so the same event can occasionally arrive twice. Each event has an ID that stays the same on every attempt, so use that to skip ones you have already handled.
If your URL does not answer with a 2xx, we try up to 3 times in total, leaving at least 10 seconds before the second attempt and 60 before the third. After 3 failures in a row the subscription is disabled and we email you. A disabled subscription cannot be switched back on, so create a new one once your endpoint is healthy and delete the old one.
You can list your subscriptions and delete any you no longer need. You only ever see your own business’s subscriptions.
The developer documentation has the exact requests, response formats and code examples for checking signatures.