Features › Integrations
Integrations and API

Your booking system
does not have to be an island

Sixteen events leave the system the moment they happen, signed and in a format every automation tool understands. Four routes let outside software read your data. Nothing gets retyped by hand.

Two directions, and the difference matters

This is the one thing worth understanding before anything else on this page. The rest is detail.

Outbound

Webhook

The system reports outward the moment something happens. It does not wait to be asked. You give an address and pick the events, and the data packet arrives on its own, in the second the event occurred.

Example: a client books at 11pm. A second later their details are in your spreadsheet, a message has gone to their Viber, and your phone has buzzed once.
Inbound

API key

Outside software reads from the booking system when it needs to. You issue a key, and it asks: which appointments since yesterday, which services exist, which staff are active.

Example: your accountant pulls the list of completed appointments for last month on the first of every month, without opening the admin and without calling you.
Most users only need the first direction. The webhook covers ninety percent of what people want, because what they actually want is for the message to send itself and the row to write itself. The API key is for when someone else needs to read your data.

Sixteen events, exactly these

Each webhook listens to the ones you assign it. One address can take a single event, another all sixteen.

Bookings

7
  • booking.createdNew booking
  • booking.canceledBooking canceled
  • booking.completedBooking completed
  • booking.status_changedStatus changed, any status
  • booking.confirmedClient confirmed attendance
  • payment.recordedPayment recorded
  • waitlist.joinedJoined the waiting list

Messages to the client

9
  • booking.reminderReminder before the appointment
  • booking.reminder2Second reminder
  • booking.no_showClient did not show up
  • customer.debt_reminderUnpaid balance reminder
  • customer.review_requestReview request
  • customer.winbackLapsed client
  • customer.rebookTime to rebook
  • customer.birthdayBirthday message
  • customer.loyaltyLoyalty reward

What exactly arrives at your address

An ordinary JSON message. This is the packet that goes out for a new booking.

POST to your URL
X-PB-Event:     booking.created
X-PB-Signature: sha256=a3f1c8...
Content-Type:   application/json

{
  "id":          1482,
  "reference":   "3BB6844B",
  "status":      "pending",
  "service":     "Women's haircut",
  "staff":       "Milica Jovanović",
  "date":        "2026-07-24",
  "time":        "17:30",
  "price":       2500,
  "amount_paid": 0,
  "customer": {
    "name":  "Ana Petrović",
    "email": "ana@primer.rs",
    "phone": "+381 60 123 4567"
  }
}
The phone number is in the packet, and that is the whole point. Because of it, every message that normally goes by email can go out as WhatsApp, Viber or SMS at the same time, through a tool you already use. The system does not send SMS itself, but it sends everything needed for someone else to send it.

Two things that separate a serious webhook from shouting into the void

Both are invisible until they matter, and then they are the only thing that matters.

A signature, so the recipient knows the message is from you

A webhook address is public. Without a signature, anyone who guesses it can push a fake booking into your spreadsheet.

  • Every packet carries a signature header, computed with HMAC-SHA256 over the message body and a secret only you and the recipient know.
  • The recipient repeats the same calculation and compares. If the signatures do not match, the message is not from you, or someone altered the contents in transit.
  • The secret itself is never sent. Only the result of the calculation travels, and the secret cannot be derived from it.
  • If you set no secret, there is no signature and the packet goes without one. It will work, but the recipient has no way to verify the sender.
This is the standard Stripe, GitHub and Shopify use for the same purpose. It was not invented here, which is exactly why every serious tool already understands it.

A test button, so you do not wait for a real booking

Without this, you test an integration by booking an appointment with yourself and watching whether anything happened.

  • The button sends a test packet to your address and shows you immediately what the server answered.
  • You see the response, not a log. If the address is wrong or the scenario is switched off, it says so on screen, at that moment.
  • Unlimited addresses, each with its own set of events and its own secret.
  • A webhook switches off with a toggle, without deleting it. The setup stays there for later.

Works with any tool that accepts an HTTP request

Zapier
Make
n8n
Pabbly
your own server

Four routes for reading data

For when outside software needs to ask, rather than wait to be told.

/auth/test Checks whether the key is valid. The first thing any integration calls.
/api/appointments Appointments with full client details. Filters by modification date, date range, status and row count.
/api/services Service catalog: name, duration, price.
/api/staff Staff catalog.

Managing keys

  • Up to twenty keys, each with its own label. Do not call them “key 1” and “key 2” but “Zapier” and “Accountant report”, because in six months you will not remember which is which.
  • You can see when a key was last used. A key sitting idle for months is either a dead integration or something you do not know about. Both are reasons to revoke it.
  • Revocation is per key. You kill one integration without touching the others.
  • The key goes in a header, as X-PB-API-Key or in the standard Authorization: Bearer form.
  • Key comparison is timing-safe, so a key cannot be guessed by measuring how long the server took to answer.

Calendar subscription, with no integration at all

Staff do not look at WordPress. They look at their phone. If the appointment is not there, for them it does not exist.

One link, added once

This asks for neither Zapier nor a developer. It asks for thirty seconds per person, once.

  • Every staff member gets their own link and sees strictly their own appointments. They add it once to Google, Apple or Outlook Calendar.
  • A global link exists for the owner or the front desk, with every appointment in one place.
  • It is a subscription, not a one-off import. A new appointment appears on its own, a canceled one disappears on its own. Not a single click after the first time.
  • It works on a watch, a phone and a laptop, because iCal is a standard every serious calendar understands. Instructions for all three systems are inside the plugin.
  • This is not the same as the “Add to calendar” button in the email. That button puts one appointment into the client's calendar. The subscription keeps a staff member's whole schedule, permanently.
Of everything on this page, this is the one item you can switch on today, without an account on any platform.
Integrations page: a webhook with event selection and a test button
Integrations in the admin: address, event selection, signing secret and the test button.

The limits of this part of the system

Integrations are pipes. What flows through them is configured by you, in a tool of your choosing.

  • There is no ready-made named connection. There is no “connect to your Zapier account” button. There is an address the system posts to, and you build the scenario. That is five minutes of work, but it is work.
  • There is no SMS, WhatsApp or Viber from the plugin itself. The system sends the event with the client's phone number, and the message is sent by a tool you choose and pay for. Which is exactly why those messages are not billed through the license.
  • There is no inbound write. The routes are read-only. Outside software cannot create an appointment through the API, only see existing ones.
  • There is no import from Google Calendar. Appointments go from the plugin into the calendar, not the other way. Whatever you entered in Google earlier stays there.
  • There is no delivery retry. If your server does not answer at that moment, the packet is missed and is not sent again. For messages that must not be lost, use a tool that retries on its own.
These are deliberate limits, not oversights. The plugin runs on your hosting and has no business obliging you to someone else's account or someone else's subscription.

Which package includes integrations

Every paid one, with no cap on calls and no charge per event.

Webhook, API and calendar

Free1 service, 1 staff member
SingleEverything, 1 site
BusinessEverything, multiple sites
AgencyEverything, for client sites
See pricing →

Questions people actually ask

For a webhook, yes. In Zapier or Make you create a step called a catch hook, you get an address, you paste it into the plugin and pick the events. Then you say what happens when a packet arrives: a Viber message, a row in a spreadsheet, a notification on your phone. Not one step asks you to write code. API keys do need someone who knows what they are doing, but most users will never open that screen.

Switch on a webhook for the reminder event and connect it to a tool that sends WhatsApp. The packet carries the name, phone, service, date, time and booking reference, so everything a message needs. The plugin still sends the email, so the client gets both, or you switch the email off. You pay for the messages to that tool, not to us, and that is why the license has no monthly charge.

That is what the signing secret is for. Someone who knows the address but not the secret cannot send a message that passes verification, because the recipient compares the signature against their own calculation. If you suspect the secret leaked too, change it in the plugin and at the recipient. The address does not need changing.

No. The packet goes out without waiting for a response, on a short timeout, so a client booking an appointment is not waiting on your Zapier. The single exception is the test button, which waits deliberately so it can show you the answer. If your server does not respond, the booking still completes normally.

Yes, and in three ways. The routes for appointments, services and staff return data as JSON. The client record has an export. The database sits on your hosting, so you can reach it directly whenever you want. There is no data lock-in, because the data is not with us, it is with you.

What travels through this

Integrations have no content of their own. They carry what the rest of the system produces.

Data retyped by hand is data that gets lost sooner or later

Sixteen events leave on their own, signed, in the second they happen. The license is paid once, and the number of calls is never billed.

See pricing → All features