Submit a booking

Submits a held booking. Depending on the business’s settings, this creates either an order or a lead, both marked Pending review. The endpoint atomically revalidates the hold, resources, services, and price before it creates the record.

POST /api/public/booking/{token}/submit

This endpoint is rate limited to 5 requests per 10 minutes per IP address and 100 requests per 10 minutes per tenant after Turnstile succeeds. It requires a valid Cloudflare Turnstile token. Send the request body as JSON (Content-Type: application/json).

For an external browser integration, register the website hostname first. Render the CRM-provided Turnstile site key with action booking_submit. The server verifies both the action and the hostname returned by Cloudflare. See CAPTCHA requirement.

Path parameters

string

required

Your booking page token (booking slug or lead token).

Headers

string

A UUID that identifies this booking attempt. Send the same key when retrying a request that timed out, and the booking is created once rather than twice.The value must be a UUID — a malformed key is rejected with 400 invalid_idempotency_key. If you omit the header, the server generates a key internally, which protects nothing across retries: a retried request without the header creates a second booking.

If you retry while the first request is still being processed, the second returns 409 booking_in_progress rather than creating a duplicate. Treat it as “wait and check”, not as a failure — back off briefly, then retry the same key.

Generate the key once, before the customer presses submit — not inside the retry. A key generated per attempt defeats the purpose.

Request body

string

required

A valid Cloudflare Turnstile token from the approved CRM booking widget on your registered hostname. The widget must use action booking_submit.

object

required

The customer’s details.

Show customer

string

required

Customer’s full name (max 100 chars).

string

required

Customer’s phone number (max 50 chars).

string

required

Customer’s email (max 255 chars).

string

Customer’s address (optional, max 255 chars).

number[]

required

One or more service IDs from the config endpoint. Send the same selection used to obtain the offer and hold; the held service snapshot remains authoritative at commit time.

string

required

The unexpired token returned by Hold or release a slot. A slot’s start time or offer_token cannot replace it.

object

Vehicle details. Required when the workspace business type is auto; optional for other business types.

Show vehicle

string

Vehicle make (required if vehicle is provided).

string

Vehicle model (required if vehicle is provided).

string

Vehicle year.

string

Body type ID (from config) — drives surcharge pricing.

number

Optional membership plan ID to enroll the customer in at booking time.

string

Optional notes from the customer (max 1000 chars).

Response

Returns 200 OK on success.

boolean

true when the booking was created.

string | null

The business’s custom confirmation message to show the customer, if configured.

string

What was created — an order or a lead. Which one you get depends on the business’s booking settings, not on your request, so read this rather than assuming. See Order vs. lead creation.

number

The identifier of the created order or lead.

string

The initial review state. New public bookings return pending_review.

boolean

true for an order that reserves the held time; false for a lead that records the requested time and releases the hold.

Retrying with the same Idempotency-Key after a success replays the original response — the same resource_id and resource_type come back, and nothing new is created.

Example

curl -X POST https://app.autodetailcrm.com/api/public/booking/your-token/submit \
  -H "Origin: https://example-detailer.com" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 9b76d415-8f9c-4df3-8c2f-290753daaf8f" \
  -d '{
    "turnstile_token": "0.abc123...",
    "customer": { "name": "Jane Doe", "phone": "+1 512 555 0100", "email": "jane@example.com" },
    "service_ids": [12, 15],
    "hold_token": "ef36ccee-09ca-4aa2-8292-5e7ee5971dcb",
    "vehicle": { "make": "Toyota", "model": "RAV4", "year": "2023", "body_type_id": "a1b2c3" },
    "notes": "Please call when you arrive."
  }'

const TOKEN = "your-token";
const bookingAttemptId = crypto.randomUUID();

const res = await fetch(
  `https://app.autodetailcrm.com/api/public/booking/${TOKEN}/submit`,
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Idempotency-Key": bookingAttemptId,
    },
    body: JSON.stringify({
      turnstile_token: turnstileToken, // from the Cloudflare Turnstile widget
      customer: { name: "Jane Doe", phone: "+1 512 555 0100", email: "jane@example.com" },
      service_ids: [12, 15],
      hold_token: hold.hold_token,
      vehicle: { make: "Toyota", model: "RAV4", year: "2023", body_type_id: "a1b2c3" },
      notes: "Please call when you arrive.",
    }),
  }
);

const result = await res.json();
if (res.ok && result.success) {
  showConfirmation(result.confirmation_message);
} else if (res.status === 409) {
  // The hold expired or availability changed; fetch new offers and ask the customer to pick again.
} else {
  showError(result.error);
}

{
  "success": true,
  "confirmation_message": "Thanks! We'll see you soon.",
  "resource_type": "order",
  "resource_id": 1042,
  "review_status": "pending_review",
  "time_reserved": true
}

Order of validation

Checks run in a fixed order, and the first failure returns immediately. This matters when you’re debugging: a request with several problems reports only the earliest one.

Token format

invalid_token

Origin and tenant domain

origin_not_allowed, origin_registry_unavailable

Body and idempotency key

invalid_body, invalid_idempotency_key

Workspace lookup

not_found — unknown token, or booking disabled

Completed idempotent replay

Returns the original successful response without creating another record

CAPTCHA

captcha_required, captcha_failed, captcha_unavailable

Rate limit

too_many_requests — checked against durable IP and tenant quotas only after CAPTCHA succeeds

Required fields

missing_customer, missing_required_customer_fields, no_services, hold_required, missing_vehicle

Atomic booking commit

offer_expired, slot_unavailable, booking_in_progress

CAPTCHA is verified before your field validation. While you’re building the integration without a working Turnstile token, every malformed request answers captcha_failed — you won’t see missing_customer or no_services until the CAPTCHA passes. Get Turnstile working first, then debug your payload.

Errors

Status	`error`	Meaning
`400`	`invalid_token`	Token format is invalid
`400`	`invalid_body`	Body is missing or not valid JSON
`400`	`captcha_required`	Turnstile token missing
`400`	`missing_customer`	No `customer` object
`400`	`missing_required_customer_fields`	`name`, `phone`, or `email` missing
`400`	`no_services`	No valid `service_ids`
`400`	`hold_required`	No valid `hold_token` was provided
`400`	`missing_vehicle`	Vehicle make and model are required for an `auto` workspace
`403`	`origin_not_allowed`	The external origin is not active for this tenant or Native Website Booking is unavailable
`403`	`captcha_failed`	Turnstile verification failed, or its action/hostname didn’t match the approved integration
`404`	`not_found`	No booking page found, or booking is disabled
`409`	`slot_unavailable`	The chosen slot is no longer free
`409`	`offer_expired`	The hold expired or the scheduling policy changed
`409`	`booking_in_progress`	A request with the same `Idempotency-Key` is still being processed
`400`	`invalid_idempotency_key`	The `Idempotency-Key` header isn’t a valid UUID
`429`	`too_many_requests`	An IP or tenant submission quota was exceeded
`503`	`origin_registry_unavailable`	The domain or plan registry could not be resolved safely
`503`	`captcha_unavailable`	CAPTCHA isn’t configured on the server
`500`	`internal_error`	Unexpected server error

Get config

Services, pricing, and settings.

Get availability

Get short-lived offers for open slots.

Hold a slot

Create the hold required by this endpoint.

Public Booking API

Website Lead Capture

Path parameters

Headers

Request body

Response

Example

Order of validation

Errors

Get config

Get availability

Hold a slot

​Path parameters

​Headers

​Request body

​Response

​Example

​Order of validation

​Errors

Get config

Get availability

Hold a slot

Path parameters

Headers

Request body

Response

Example

Order of validation

Errors