API and integrations

API key

Cabinet → “Integrations” → “Create key”. The key is shown once — keep it on your server. Send Authorization: Bearer dk_live_… with every request. Limit: 120 requests per minute per key.

https://dentum.uz/api/cabinet/v1

Endpoints

curl https://dentum.uz/api/cabinet/v1/bookings?since=2026-10-01T00:00:00Z \
  -H "Authorization: Bearer dk_live_…"

curl -X POST https://dentum.uz/api/cabinet/v1/bookings/D-261001-K3F7/status \
  -H "Authorization: Bearer dk_live_…" -H "Content-Type: application/json" \
  -d '{"status":"confirmed"}'

curl -X PUT https://dentum.uz/api/cabinet/v1/busy \
  -H "Authorization: Bearer dk_live_…" -H "Content-Type: application/json" \
  -d '{"from":"2026-10-03T00:00:00+05:00","to":"2026-10-17T00:00:00+05:00","source":"my-crm",
       "blocks":[{"start":"2026-10-03T15:00:00+05:00","end":"2026-10-03T16:30:00+05:00","id":"visit-881"}]}'

Booking object

Times are Asia/Tashkent (+05:00). Patient data is only for handling the booking at your clinic.

{
  "ref": "D-261001-K3F7",
  "status": "requested",
  "service": "Имплантация",
  "source": "web",
  "created_at": "2026-10-01T09:12:44.120Z",
  "updated_at": "2026-10-01T09:12:44.120Z",
  "slot": { "start": "2026-10-03T10:00:00+05:00", "preference": null, "timezone": "Asia/Tashkent" },
  "patient": { "name": "Азиз", "phone": "+998901234567", "telegram_linked": true }
}

No double bookings

When your CRM sends busy times via PUT /v1/busy, Dentum will not offer them to patients or AI agents. Send a window (e.g. the next 14 days) every 5–15 minutes.

Webhooks

Set an https URL in the cabinet — the secret (whsec_…) is shown once. Events: booking.created, booking.updated (with previous_status), ping. Reply 2xx within 8 seconds; otherwise we retry after 1 min, 5 min, 30 min, 2 h, 6 h, 12 h (7 attempts in total). Always verify the signature:

Dentum-Signature: t=<unix>,v1=<hex> — HMAC-SHA256(secret, t + "." + raw body). Reject t older than 5 minutes.

import { createHmac, timingSafeEqual } from 'node:crypto';

// raw — тело запроса строкой, как пришло (до JSON.parse)
export function verifyDentum(raw, header, secret) {
  const m = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header || '');
  if (!m || Math.abs(Date.now() / 1000 - Number(m[1])) > 300) return false;
  const want = createHmac('sha256', secret).update(m[1] + '.' + raw).digest();
  const got = Buffer.from(m[2], 'hex');
  return got.length === want.length && timingSafeEqual(got, want);
}

function verify_dentum(string $raw, string $header, string $secret): bool {
  if (!preg_match('/^t=(\d+),v1=([0-9a-f]{64})$/', $header, $m)) return false;
  if (abs(time() - (int)$m[1]) > 300) return false;
  return hash_equals(hash_hmac('sha256', $m[1] . '.' . $raw, $secret), $m[2]);
}

Calendar (ICS)

The link is in the cabinet, “Calendar”. Google Calendar: “Other calendars” → “+” → “From URL”. Apple: “File” → “New Calendar Subscription”. Google refreshes subscriptions every few hours — use the Telegram chat for instant alerts. Phones are masked in the calendar (full number in the cabinet).

Specification

OpenAPI 3.1: /openapi-clinic.json

Questions: info@dentum.uz or @dentumcrmbot. A separate API for AI agents — for AI agents.