Quickstart
Make your first call in five minutes
The Brightloom API is a JSON over HTTPS API. Every endpoint lives under https://api.brightloom.dev/v1, every request needs one header, and there is no SDK to install.
Base URL
https://api.brightloom.dev/v1
All requests must be HTTPS. Plain HTTP requests are rejected rather than redirected, so a misconfigured client fails loudly instead of leaking a key.
Authentication
Authenticate with a bearer token in the Authorization header. Keys are created per environment in the Brightloom admin under Settings → API keys, and they are shown once.
Authorization: Bearer blk_live_8fk2Qz7mR4tPvXc1
Test keys are prefixed blk_test_ and operate against a sandbox clinic with synthetic data. Nothing in the sandbox sends a real message to a real patient.
Your first call
This lists the ten most recent schedule events for your clinic. If it returns data, you are done with setup.
Request
curl https://api.brightloom.dev/v1/events?limit=2 \
-H "Authorization: Bearer blk_test_8fk2Qz7mR4tPvXc1" \
-H "Accept: application/json"
Response — 200 OK
{
"data": [
{
"id": "evt_8fk2",
"type": "appointment.cancelled",
"clinic_id": "cln_4t7q",
"appointment_id": "apt_91xd",
"starts_at": "2026-08-04T14:20:00Z",
"duration_minutes": 20,
"recoverable": true,
"created_at": "2026-07-29T09:14:22Z"
},
{
"id": "evt_8fk1",
"type": "offer.accepted",
"clinic_id": "cln_4t7q",
"appointment_id": "apt_91wc",
"attendee_id": "att_2m8v",
"created_at": "2026-07-29T09:11:04Z"
}
],
"has_more": true,
"next_cursor": "evt_8fk0"
}
Gotchas
- All timestamps are RFC 3339 in UTC. Clinic-local times are never returned; convert using the clinic’s
timezonefield. - Pagination is cursor-based. Pass
next_cursorasstarting_after; page numbers are not supported. - Rate limit is 120 requests per minute per key. Exceeding it returns
429with aRetry-Afterheader. - Never call the API from a browser. Keys are server-side only, and the API sends no CORS headers by design.