Calendar
Appointment calendars, delegated calendar setup, and agent calendars (agentcalendar.one).
Approve or dismiss an agent's calendar request
A company admin's click. The request moves proposed to approved through the caller's RLS
client, then the calendar is ordered as that admin: the native identity, the CalDAV principal
and calendar, the read share and the calendar routing row. A re-click answers the settled
state (202 creating, or 200 completed with store_calendar_href).
Approve or dismiss an agent's calendar request › Request Body
requestIdactionApprove or dismiss an agent's calendar request › Responses
The click was recorded, or the request had already completed.
requestIdapprovedcancelledstatusstore_calendar_hrefresult_codeThe free slots of one day on an agent calendar
From the native booking core (the calendar's slot rules minus confirmed bookings); on a
delegated_google calendar (#5340) the Google calendar's busy time (freeBusy) is removed too,
and a Google token that is revoked or lacks the calendar scope is 409
google_reconnect_required / google_scope_missing (fail closed). Name the
owner with exactly one of avatar_type or external_agent_id; the organization is the key's.
query Parameters
dayavatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
The free slots of one day on an agent calendar › Responses
The day's free slots.
dayList bookings on an agent calendar in a window (at most 92 days)
query Parameters
fromISO 8601 instant with an offset.
toISO 8601 instant with an offset.
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
List bookings on an agent calendar in a window (at most 92 days) › Responses
The bookings overlapping the window.
Book a slot on an agent calendar
A developer key's booking is charged one credit (refunded when the core refuses); the avatar's own (service lane) is not. Idempotency-Key is required: a retry
with the same key and slot answers 200 replayed: true and charges nothing again. The booking
is projected onto the agent's CalDAV calendar (projection_state) and booking.created is
sent to the owner's webhook. On a delegated_google calendar (#5340) it is projected into the
Google calendar instead (same states; a Google-side edit is conflict, never overwritten), and
a slot Google shows busy is 409 slot_taken before any charge.
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Headers
Idempotency-KeyBook a slot on an agent calendar › Responses
A replay of the same Idempotency-Key.
replayedprojection_stateWhere the booking stands on the agent's CalDAV calendar (ADR-003): conflict means the event
was changed or deleted there by someone else; the booking still holds and the event is not
overwritten until reviewed.
Move a booking (revision-guarded)
A stale expected_revision is 409 stale_revision with details.current_revision; a taken slot is 409 slot_taken.
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Move a booking (revision-guarded) › Responses
Moved.
replayedprojection_stateWhere the booking stands on the agent's CalDAV calendar (ADR-003): conflict means the event
was changed or deleted there by someone else; the booking still holds and the event is not
overwritten until reviewed.
Cancel a booking (revision-guarded)
query Parameters
booking_idexpected_revisionavatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Cancel a booking (revision-guarded) › Responses
Cancelled.
replayedprojection_stateWhere the booking stands on the agent's CalDAV calendar (ADR-003): conflict means the event
was changed or deleted there by someone else; the booking still holds and the event is not
overwritten until reviewed.
Read one event on the agent's calendar
Answers the VCALENDAR text (managed, CalDAV) or the Google event's fields (delegated_google,
#5340, routed to the Google calendar) and its ETag (also in the ETag header).
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
uidfromList: range start (required without uid).
ISO 8601 instant with an offset.
toList: range end (required without uid).
ISO 8601 instant with an offset.
cursorlimitRead one event on the agent's calendar › Responses
The event, or a page of the range's events.
Decision Table
| Variant | Matching Criteria |
|---|---|
| type = object · requires: uid | |
| type = object · requires: events, next_cursor |
uidicsThe VCALENDAR text the store holds (managed).
The Google event's fields (delegated_google).
etagCreate an event on the agent's own CalDAV calendar
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Create an event on the agent's own CalDAV calendar › Request Body
Create an event on the agent's own CalDAV calendar › Responses
Created (uid is evt-<uuid>; on a delegated Google calendar evt + 32 hex, a Google event id).
Replace an event (If-Match its ETag)
Without If-Match 428; a moved ETag 412. A booking's projection (a uuid UID; on Google bk + 32 hex) is 409 booking_event.
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Headers
If-MatchReplace an event (If-Match its ETag) › Request Body
uidsummarystart_atISO 8601 instant with an offset.
end_atISO 8601 instant with an offset.
sequenceRFC 5545 SEQUENCE; bump it on every change.
descriptionReplace an event (If-Match its ETag) › Responses
Replaced.
Delete an event (If-Match its ETag)
query Parameters
uidavatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Headers
If-MatchDelete an event (If-Match its ETag) › Responses
Deleted.
uiddeletedThe private ICS feed of one shared agent calendar (subscribe in Google, Apple, Outlook)
The acf_… token minted by agent-calendar-shares is the last path segment (calendar clients
cannot send a header or a JWT; Supabase routes the sub-path to the function). The token is stored only as its SHA-256 and names one calendar; a revoked share, an
unknown token or a calendar that is no longer active answers 404. The body is one RFC 5545
VCALENDAR (METHOD:PUBLISH) of the calendar's events from 30 days back to 365 days ahead,
without cancelled events or alarms. Read-only: any other method is 405. ETag is a strong
validator over the body; If-None-Match answers 304. Rate-limited per client address and per
token (429 with Retry-After).
path Parameters
feed_token^acf_[A-Za-z0-9_-]{4… · requiredThe private feed token (acf_ + 43 base64url characters) from an agent-calendar-shares create; the URL ends <feed_token>.ics.
Headers
If-None-MatchThe private ICS feed of one shared agent calendar (subscribe in Google, Apple, Outlook) › Responses
The calendar.
The feed's validators without its body
path Parameters
feed_token^acf_[A-Za-z0-9_-]{4… · requiredThe private feed token (acf_ + 43 base64url characters) from an agent-calendar-shares create; the URL ends <feed_token>.ics.
The feed's validators without its body › Responses
The feed's headers (ETag, Last-Modified).
Who may book on an agent calendar
The key's user must be a company admin or manager (checked in SQL).
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Who may book on an agent calendar › Responses
Current staff grants.
Grant or change a staff member's booking rights
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Grant or change a staff member's booking rights › Request Body
user_idcan_createcan_movecan_cancelGrant or change a staff member's booking rights › Responses
The grant now in force.
grantRevoke a staff member's booking rights
query Parameters
user_idavatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
Revoke a staff member's booking rights › Responses
Revoked.
revokeduser_idRe-drive booking projections and detect external edits on agent calendars
Service-only scheduled pass. For each active agent calendar's upcoming bookings: a pending or
failed projection is written again; a projected one is read back, and an event changed or
deleted on the store by someone else becomes conflict (never overwritten) and sends
booking.conflict to the owner's webhook.
Re-drive booking projections and detect external edits on agent calendars › Responses
The pass summary.
calendarsexaminedprojectedfailedconflictscalendarFailuresThe exact calendar an agent's calendar approval card offers
The avatar worker's service-role call for a recorded proposed request. Computes and checks
the calendar the admin's click would get; creates nothing.
The exact calendar an agent's calendar approval card offers › Request Body
request_idThe exact calendar an agent's calendar approval card offers › Responses
The quote (available: false names its reason).
calendar_href/dav/cal/<account>/agent on the calendar store; null for delegated_google (#5340: the Google calendar is chosen after the admin's consent).
provideravailabledisplay_namereasonprovider_not_orderable is no longer answered (#5340 orders delegated_google); it stays for requests recorded before.
Release the calendars of organizations unpaid past the 7-day grace
Service-only daily pass. Default-off: 423 until AGENT_CALENDAR_RELEASE_ENABLED=1 is in the
Vault platform store (vendor), because a release destroys the calendar's store principal.
Release the calendars of organizations unpaid past the 7-day grace › Responses
The pass summary.
examinedgraceStartedgraceClearedreleasedfailedThe calendar's live shares (never a token)
Three callers: a developer key (owner in the query), the avatar worker's service key
(organization_id, the owner, and requested_by, a company admin), or a signed-in company
admin's Supabase JWT from the staff workspace (organization_id + identity_id).
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
requested_byService lane: the session's signed-in user; must be a company admin.
identity_idStaff lane: the calendar's native identity (with organization_id).
The calendar's live shares (never a token) › Responses
Live shares, newest first.
Share the calendar with an email address
Mints a private ICS feed URL (returned here once, and emailed; stored only as a SHA-256) and
emails the subscribe links (Google Calendar, webcal:// for Apple Calendar and Outlook, and
the https URL). With caldav_account (the recipient's own store login, local@domain) the
calendar's WebDAV ACL also grants that principal read. Sharing again with the same email
rotates the URL (the old one answers 404). A failed email keeps the share
(email_status: failed). At most 20 new shares per calendar an hour (429).
query Parameters
avatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
requested_byService lane: the session's signed-in user; must be a company admin.
identity_idStaff lane: the calendar's native identity (with organization_id).
Share the calendar with an email address › Request Body
emailcaldav_accountThe recipient's own login on the calendar store (local@domain), granted CalDAV read.
Share the calendar with an email address › Responses
Shared. The feed URLs appear only in this answer and the email.
Revoke a share (its feed URL answers 404 from then on)
A share with CalDAV access also leaves the calendar's ACL; if the store cannot be reached that is 503 acl_not_updated (the feed is already revoked) and a repeat DELETE retries it.
query Parameters
share_idavatar_type^[a-z][a-z0-9_]{1,63…The calendar's owner when it is a roster avatar (exactly one of this or external_agent_id).
external_agent_idThe calendar's owner when it is an external agent (exactly one of this or avatar_type).
organization_idThe service lane (the avatar worker, bearer = the service-role key) names its subject organization here; required on that lane, ignored for a developer key (the key's organization is used).
requested_byidentity_idRevoke a share (its feed URL answers 404 from then on) › Responses
Revoked.
idrevokedWhere an agent's own calendar stands
The avatar worker's service-role read. Never the credential.
Where an agent's own calendar stands › Request Body
organization_idavatar_typeA roster avatar type, or an external agent's subject agent:<uuid>.
Where an agent's own calendar stands › Responses
The live calendar's state and readiness.
stateprovidercalendar_hrefreadylast_errorRedeem a signed, short-lived appointment cancellation proof
Public. The signed claims, never request fields, select the calendar and event.
Redeem a signed, short-lived appointment cancellation proof › Request Body
proofRedeem a signed, short-lived appointment cancellation proof › Responses
Cancelled.
noSendSelected Google appointment calendar (no-send setup, sync, staff follow-up, reschedule, cancel)
One action per call. A signed-in staff member calls with their JWT; the avatar worker may
call with the service key for staff_queue, link_contact, dismiss,
available_slots, issue_reschedule_proof and reschedule, naming the staff member in
actorUserId. Every action re-checks membership, the receptionist and its owner's
connected Google Calendar. Nothing here sends a message (noSend: true).
Selected Google appointment calendar (no-send setup, sync, staff follow-up, reschedule, cancel) › Request Body
Selected Google appointment calendar (no-send setup, sync, staff follow-up, reschedule, cancel) › Responses
The action's result. Shape depends on action.
noSendConnect an installed Employee, or an approved agent calendar, to a Google Calendar
operation selects the step: read status, list_connections, list_calendars on one
connection, select_calendar, or replace_calendar (swap a revoked or changed
selection). Errors carry the contract code (calendar/forbidden, calendar/conflict,
calendar/invalid, calendar/unavailable, calendar/unsupported) as both error and code.
#5340: an agent calendar ordered with provider: delegated_google completes here after the
approving admin's Google consent (the existing oauth-connect flow): agent_calendar_connections,
agent_calendar_calendars, then agent_calendar_bind, keyed by the approved request. Their
refusals carry their own codes (see AgentCalendarBind).
Connect an installed Employee, or an approved agent calendar, to a Google Calendar › Request Body
Decision Table
| Variant | Matching Criteria |
|---|---|
| type = object · operation="status" · requires: organizationId, employeeId | |
| type = object · operation="list_connections" · requires: organizationId, employeeId | |
| type = object · operation="list_calendars" · requires: organizationId, employeeId, connectionId | |
| type = object · operation="select_calendar" · requires: organizationId, employeeId, connectionId +1 more | |
| type = object · operation="replace_calendar" · requires: organizationId, employeeId, previousIdentityId +2 more | |
| type = object · operation="agent_calendar_connections" · requires: organizationId, requestId | |
| type = object · operation="agent_calendar_calendars" · requires: organizationId, requestId, connectionId | |
| type = object · operation="agent_calendar_bind" · requires: organizationId, requestId, connectionId +1 more |
Connect an installed Employee, or an approved agent calendar, to a Google Calendar › Responses
The operation's result.
noSend