Quickstart

Make your first call in five minutes

The Brightloom API is a JSON over HTTPS API. Every endpoint lives under https://api.brightloom.dev/v1, every request needs one header, and there is no SDK to install.

Base URL

https://api.brightloom.dev/v1

All requests must be HTTPS. Plain HTTP requests are rejected rather than redirected, so a misconfigured client fails loudly instead of leaking a key.

Authentication

Authenticate with a bearer token in the Authorization header. Keys are created per environment in the Brightloom admin under Settings → API keys, and they are shown once.

Authorization: Bearer blk_live_8fk2Qz7mR4tPvXc1

Test keys are prefixed blk_test_ and operate against a sandbox clinic with synthetic data. Nothing in the sandbox sends a real message to a real patient.

Your first call

This lists the ten most recent schedule events for your clinic. If it returns data, you are done with setup.

Request

curl https://api.brightloom.dev/v1/events?limit=2 \
  -H "Authorization: Bearer blk_test_8fk2Qz7mR4tPvXc1" \
  -H "Accept: application/json"

Response — 200 OK

{
  "data": [
    {
      "id": "evt_8fk2",
      "type": "appointment.cancelled",
      "clinic_id": "cln_4t7q",
      "appointment_id": "apt_91xd",
      "starts_at": "2026-08-04T14:20:00Z",
      "duration_minutes": 20,
      "recoverable": true,
      "created_at": "2026-07-29T09:14:22Z"
    },
    {
      "id": "evt_8fk1",
      "type": "offer.accepted",
      "clinic_id": "cln_4t7q",
      "appointment_id": "apt_91wc",
      "attendee_id": "att_2m8v",
      "created_at": "2026-07-29T09:11:04Z"
    }
  ],
  "has_more": true,
  "next_cursor": "evt_8fk0"
}

Gotchas

  • All timestamps are RFC 3339 in UTC. Clinic-local times are never returned; convert using the clinic’s timezone field.
  • Pagination is cursor-based. Pass next_cursor as starting_after; page numbers are not supported.
  • Rate limit is 120 requests per minute per key. Exceeding it returns 429 with a Retry-After header.
  • Never call the API from a browser. Keys are server-side only, and the API sends no CORS headers by design.