Skip to main content

Model Context Protocol

Let approved AI clients use venue context.
Keep authority on the server.

Booking Bible exposes a stateless JSON-RPC endpoint using MCP protocol 2025-03-26. It is a venue-scoped interface over selected data and narrowly permissioned operations.
Try the endpoint manifestExplore the REST API
  • HTTP transport
  • API-key scopes
  • Audited tools

Quick start

A standard JSON-RPC request

Use a Booking Bible API key whose plan and provisioning allow API access. Rate limits follow that key’s configured API allowance.

bash
curl https://bookingbible.com/api/mcp \
  --request POST \
  --header "Content-Type: application/json" \
  --header "X-API-Key: bb_live_..." \
  --data '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list"
  }'
json
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "search_schedule",
    "arguments": { "date": "2026-07-28" }
  }
}

To create Flash Sales, issue a new custom API key with write:marketing. Keys created before writable MCP tools were introduced must be reissued so the server can retain the creating staff identity for the audit trail.

json
{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "create_flash_sale",
    "arguments": {
      "name": "Autumn membership offer",
      "commercial_rule": {
        "version": 2,
        "kind": "introductory_price",
        "pricing": { "mode": "shared", "price": 99 },
        "currency": "DKK",
        "vatMode": "included",
        "waiveRegistrationFeePassTypeIds": [],
        "duration": { "mode": "until_date", "endsAt": "2026-10-01" },
        "followingPrice": { "mode": "pass_price" }
      },
      "product_family": "recurring",
      "applicable_pass_type_ids": ["00000000-0000-4000-8000-000000000000"],
      "starts_at": "2026-08-25T00:00:00.000Z",
      "ends_at": "2026-10-01T00:00:00.000Z",
      "placements": ["public_link", "pricing_page", "global_app"]
    }
  }
}

Resources

Addressable, venue-scoped views

Resource URIs carry only the requested view parameters. The authenticated API key supplies the venue boundary.

URI templatePurposeRequired scope
venue://schedule/{date}Daily scheduleread:schedule
venue://classes/{date_range}Class instances by date rangeread:schedule
venue://members/{query}Member searchread:members
venue://member/{id}Member detailread:members
venue://passesActive pass typesread:passes
venue://bookings/{date}Bookings for dateread:bookings
venue://revenue/{period}Revenue summaryread:reports
venue://alertsActive alertsread:operations

Tools

Narrow operations with explicit schemas

The client discovers JSON input schemas through tools/list. The server validates every call before querying venue data.

search_schedule

Find classes on a date, optionally filtered by class type or instructor name. Returns up to 100 instances.

read:schedule

check_availability

Returns capacity, current bookings, and remaining seats for a class instance.

read:schedule

search_members

Search venue members by name, email, or client display ID. Returns up to 25 matches.

read:members

get_member_details

Full member profile with active passes and most recent bookings.

read:members

get_revenue_summary

Revenue totals by currency for a period (today / week / month / YYYY-MM-DD..YYYY-MM-DD).

read:reports

get_today_overview

Today's class count + booking count + open alert count — fast snapshot for an AI assistant's home view.

read:schedule + read:bookings + read:operations

create_flash_sale

Create a venue-scoped Flash Sale offer. This tool never creates or sends a marketing campaign.

write:marketing

Security boundary

Useful context with explicit authority

MCP does not bypass the API access gate, key scopes, tenant isolation, rate limits or the platform’s emergency kill switch.

One scoped API key

The server reuses Booking Bible API keys. Every resource and tool declares the exact read or write scopes it requires.

Venue scope from authentication

The organization comes from the authenticated key, never from a model-provided URI or tool argument.

Audited and row-capped

Tool calls pass through the AI audit chokepoint and enforce per-tool result ceilings before returning data.

Narrow writes by design

Write tools reuse server-side business rules. Flash Sale creation cannot send a campaign, email or SMS.

Build with the right surface

MCP for contextual reads and narrow operations. REST for full application workflows.

Use the least-privileged key for the work at hand. Add write:marketing only when the client must create Flash Sales, and keep unrelated write scopes off that key.

Contact integrationsRead the developer overview