Calendly

Twin of the Calendly API v2.


Covers	`api.calendly.com`, `auth.calendly.com`
Auth	Personal access tokens, OAuth 2.1
Webhooks	Yes
Operations	33

Coverage

Users, organizations and memberships, event types, availability schedules, derived available and busy times, scheduled events and invitees, cancellations, no-shows, routing forms, single-use scheduling links and webhook subscriptions.

Calendly splits its data API and its OAuth issuer across two hosts in production, and the twin serves both path sets on one base URL, so point both of your configured hosts at the same place.

Credentials

Personal access tokens and OAuth 2.1 access tokens both ride Bearer and both work on every route. Any well-formed one authenticates by default, so your existing token needs no change. Set auth.mode to enforced to accept only what the world knows. See Credentials.

OAuth tokens carry scopes, and one missing a scope gets a 403 Insufficient scope with a required_scopes array. A personal access token carries the user’s full access, as it does at the vendor.

Vendor specific details

Every object is addressed by a full URI, not a bare id, and list filters take URIs too. A bare UUID is a 400 Invalid Argument, while a well-formed URI for something that does not exist is a 404.
The credential is checked before the router, so a typo’d path with no credential is a 401 rather than a 404. The Bearer scheme is case sensitive and takes exactly one space.
Event types, scheduled events and organization memberships all refuse to list without user or organization.
Pagination count is the rows in the page you got, not the page size you asked for, and a page_token that was never issued here is a 400 rather than a silent first page.
Cancelling an already-cancelled event is a 403 saying it is already cancelled. Not a 409, and not idempotent.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.