For developers

Alchem HTTP API and webhooks

Read and create bookings and clients, get specialists’ free time and business events. The salon issues the key itself — with the permissions and rate limit you need.

Try for free Partners

Request: a specialist’s free time

GET /availability

Base URL

https://rest.business.eywa.uz/partner/v1

curl

curl "https://rest.business.eywa.uz/partner/v1/availability?staff_id=<staff_id>&service_ids=<service_id>&date=2026-10-01" \
  -H "Authorization: Bearer alk_…"

How access works

The salon sets the key, permissions and limit — you get exactly what you were given.

The salon issues the key

In Settings → Integrations → API keys: name, permissions, branches and expiry. The key is shown once — it never appears in responses or logs. Revoke it any time.

Authorization header

Every request carries an Authorization: Bearer header with the key. No key or a revoked key — a 401 response.

Rate limit

From 10 to 1200 requests per minute per key, 300 by default. Over the limit — a 429 with a Retry-After header.

Key permissions

A key sees only what it’s allowed to — and never more than the staff member who issued it can do right now. Client contacts are a separate permission.

Standard errors

Errors come as application/problem+json (RFC 9457): a code, a readable message and the request path.

Time, money, lists

Time is RFC 3339 with the branch time zone offset, money is in minor units. Lists are paginated: limit up to 100, then follow next_cursor.

Key permissions

Write access to a section includes reading it; client contacts are only granted explicitly.

Business and branchesbusiness:read
Services and categoriesservices:read
Specialists and staffstaff:read
Specialists’ free timeavailability:read
Bookings: readappointments:read
Bookings: create, reschedule, change status, deleteappointments:write
Clients: read without contactsclients:read
Client contacts: phone and emailclients:read_contact
Clients: createclients:write
Eywa Connect call logcalls:read

Endpoints

All paths are relative to the base URL https://rest.business.eywa.uz/partner/v1. On the right — the permission the key needs.

GET/meThe key: business, permissions, branches and limit
POST/revokeRevoke the key used for the request
GET/businessBusinessbusiness:read
GET/locationsBranchesbusiness:read
GET/servicesServices; filter by branch and categoryservices:read
GET/service-categoriesService categoriesservices:read
GET/staffSpecialists; filter by branch and servicestaff:read
GET/availabilityA specialist’s free time for a dayavailability:read
GET/appointmentsBookings for a period, changed after a date, by specialist or clientappointments:read
GET/appointments/{id}A single bookingappointments:read
POST/appointmentsCreate a booking — for a new or existing clientappointments:write
PATCH/appointments/{id}Reschedule a booking, change its status or commentappointments:write
DELETE/appointments/{id}Delete a bookingappointments:write
GET/clientsClients; search by phoneclients:read
GET/clients/{id}A single clientclients:read
POST/clientsAdd a clientclients:write
GET/callsEywa Connect calls for a periodcalls:read
GET/references/countriesCountries reference
GET/references/business-typesBusiness types reference
POST/app/callbackA partner app confirms the installationapp key
POST/app/redirectWhere to send the user after setting up the appapp key

Request examples

Request: a new booking

POST /appointments

curl

curl -X POST "https://rest.business.eywa.uz/partner/v1/appointments" \
  -H "Authorization: Bearer alk_…" \
  -H "Content-Type: application/json" \
  -d '{
    "staff_id": "<staff_id>",
    "service_ids": ["<service_id>"],
    "starts_at": "2026-10-01T10:00:00+05:00",
    "client": { "name": "Dilnoza", "phone": "+998901234567" },
    "comment": "…",
    "api_id": "order-1042"
  }'

Response

GET /availability · 200

JSON

{
  "object": "availability",
  "date": "2026-10-01",
  "time_zone": "Asia/Tashkent",
  "staff_id": "<staff_id>",
  "location_id": "<location_id>",
  "is_working_day": true,
  "duration_minutes": 60,
  "step_minutes": 15,
  "slots": [
    { "starts_at": "2026-10-01T10:00:00+05:00", "ends_at": "2026-10-01T11:00:00+05:00" },
    { "starts_at": "2026-10-01T10:15:00+05:00", "ends_at": "2026-10-01T11:15:00+05:00" }
  ]
}

Webhooks

The salon subscribes your URL to events in Settings → Integrations → Webhooks — for the whole business or selected branches.

What you receive

A POST with JSON: event, delivered_at, business_id and data — the entity itself. Headers X-Eywa-Event and X-Eywa-Delivery-Id.

Signature

If the subscription has a secret, X-Eywa-Signature holds the hex HMAC-SHA256 of the request body. You can add your own headers too.

Retries

A 2xx response means delivered. Otherwise we retry after 5, 15, 60 and 60 minutes — up to five attempts in total; we wait 15 seconds for a response. The delivery log and manual retry are in settings.

Bookingsappointment.createdappointment.updatedappointment.cancelledappointment.completedappointment.deleted
Clientsclient.createdclient.updatedclient.deleted
Servicesservice.createdservice.updatedservice.deleted
Service categoriesservice_category.createdservice_category.updatedservice_category.deleted
Staffstaff.createdstaff.updatedstaff.deleted
Scheduleschedule.updated
Brancheslocation.createdlocation.updatedlocation.deleted
Productsgood.createdgood.updatedgood.deleted
Inventory operationsgoods_operation.salegoods_operation.receiptgoods_operation.consumablegoods_operation.stolengoods_operation.movegoods_operation.other
Finance operationsfinance_operation.createdfinance_operation.updatedfinance_operation.deleted

Building an app for many salons?

Instead of a key from every salon — an app in the Alchem catalog: a salon grants access in one click, and you manage installations through the partner API.

Partners Integrations

Try Alchem in your own salon

7 days free, every feature included. Or look around the demo salon first — no sign-up.

Try for free Try the demo