TattooBookingDevelopers

Changelog

Every public API change, in chronological order. Subscribe to email updates by adding developers@tattoobooking.com to your address book (real subscription feed coming in Phase 7).

2026-05-27 — Developer platform launch

Added

  • OAuth 2.0 authorization server. Full RFC 6749 + 7636 (PKCE) + 7009 + 7662 + 8414 compliance. Endpoints at /oauth/authorize,/oauth/token, /oauth/revoke, /oauth/introspect,/.well-known/oauth-authorization-server.
  • Outbound webhooks. 32 public event types, HMAC-SHA256 signing with rotation, exponential retry over 72h, auto-pause on 50 consecutive failures. Full CRUD at /v1/webhook_endpoints.
  • /v1/ideas — tattoo idea CRUD. Full TattooIdea field coverage (30+ properties). Filter by client, assigned artist, stage, source type, BTT status, archived status.
  • /v1/event_types — read-only. 40+ EventType fields including public booking URL.
  • /v1/zapier/* — REST Hooks shim. Powers the official Zapier app (5 triggers + 3 actions + 1 search in v1).
  • Expanded DTOs. Form (+4 fields), FormSubmission (+8), Appointment (+4 + event_type_id properly prefixed), Lead (+2). Every DTO now exposes the full set of non-secret fields from the underlying Prisma model.

Plan-gated

  • API access, outbound webhooks, and Zapier integration are unlocked at the Solo plan ($49/mo). The Light (free) tier is locked out.
  • Custom OAuth app registration is unlocked at Studio.

Security

  • Google Calendar OAuth tokens encrypted at rest (AES-256-GCM). Rolling migration in progress — reads flip to encrypted on 2026-06-03, plaintext columns dropped on 2026-06-10.
  • Twilio inbound webhook receiver wired with proper signature verification (was silently broken).

2026-04-15 — Public API foundation

  • Initial /v1/* surface: clients, appointments, leads, forms, submissions, artists, shops, events, webhook_endpoints (stubs), me.
  • RFC 9457 problem+json error responses, cursor pagination, prefixed IDs.
  • API key auth with scopes (25 canonical scopes), IP allowlist, rotation, audit log.
  • Redis-backed tiered rate limiting (free / standard / pro / custom).
  • Postgres-backed idempotency keys (24h window).