API keys and webhooks (connecting other software)

If your clinic uses other software, an EPOS till, a marketing platform, a reporting dashboard, or automation tools like Zapier, you can connect them to AesthetiClinic yourself with API keys and webhooks. This is for technically confident users or whoever builds your integrations; nothing here is needed for day-to-day clinic use.

API keys

1. Go to Settings → Integrations → Manage API keys (owners only).
2. Create a key and choose its scopes, which decide what it can reach: operations (patients, appointments), accounts (payments), EPOS (products, stock), marketing (reviews, consents), or the Booking agent preset for a chat or AI booking tool. Give a key only the scopes its integration needs.
3. The key is shown once, copy it somewhere safe. You can roll a key with an overlap of up to 24 hours, ending sooner if the old key expires, or revoke it instantly.

Every key's activity is logged, and you can restrict a key to specific IP addresses. Access to full medical records has additional safeguards and its own acknowledgement step, most integrations should not request it.

Creating patients through the API

A patient created through the API needs the same details as a patient booking online: first and last name, email, phone, date of birth, address and postcode (town or city is optional), and, if your clinic has referral-source options, the answer to "How did you hear about us?" as referral_source, which must be one of those options (a friend's name can go in referral_friend_name). If the details are not available yet, for example a booking taken over the phone, send details_to_follow: true with the name and an email or phone number instead; the patient is saved as Details incomplete if required contact or demographic details are missing and your team can send them a link to add the rest. Anything you do send is still checked, so a malformed postcode or an impossible date of birth is refused either way.

A key for a booking agent

If a chat or AI booking tool books on your behalf, give it the Booking agent preset rather than the operations scopes. That key can see your services, staff and availability, look a patient up by their exact email address or mobile number, create a patient with the required details, hold a slot pending its reservation fee, cancel a hold it made, and send a payment link. It cannot read patient records, search your patient list, or confirm a booking: a booking is confirmed when the fee is paid. Exact patient lookups are limited to 500 a day. If you already gave a booking tool a key with the operations scopes, create a new key with the preset, move the tool to it, and revoke the old one; a key's scopes cannot be changed after it is created.

Webhooks

Webhooks push events to your systems in real time: appointments booked, changed or cancelled, patients created or updated, payments succeeding or refunded, gift vouchers issued, bought or redeemed, stock moving, products changing and reviews arriving. Set them up under Settings → Integrations → Manage webhooks: give a public HTTPS address, tick the events to send, and copy the signing secret, which is shown once. For privacy, webhook payloads contain record IDs and limited values such as status, amounts and currency, while omitting patient contact and clinical details; your integration fetches further detail through the scoped API. Each delivery is signed in the X-AC-Signature header so your endpoint can verify it really came from AesthetiClinic. A delivery gets up to five attempts in total, with retries becoming eligible 1 minute, 5 minutes, 30 minutes and 2 hours after the preceding failure. After its last failure, that delivery is marked dead. After 20 consecutive deliveries exhaust their attempts, the endpoint is disabled and a notice is emailed to its creator if they still have an active seat, otherwise to an active owner. You can resume it from the same page once it is fixed; resuming releases pending deliveries, but does not replay dead ones.

Keys can expire after 90 days or 1 year, or be set to Never. Choose it when you create the key, and replace or roll the key before it expires. For API writes that support idempotency, reuse the same idempotency key when retrying the same request.

One responsibility to understand

When you connect a third-party tool, that tool's provider processes your data on your instructions, so your clinic is responsible for having an appropriate data-processing agreement with them. The key-creation screen reminds you of this at the moment it matters.