Upcoming appointments for a phone number
Reads only — a POST because the phone number belongs in a body, not in a URL that logs keep. Each entry carries an `actionToken` — the handle the `scheduling.modify` endpoints require — and the patient’s masked name. Required scope: `scheduling.read`.
/scheduling/appointments/searchAuthorization
ApiKeyAuth An external API key, sent as Authorization: Bearer mflo_…. Scopes are checked per route; see each operation’s description.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/scheduling/appointments/search" \ -H "Content-Type: application/json" \ -d '{ "contactPhone": "string" }'{ "data": [ { "actionToken": "string", "patientMaskedName": "string", "start": "string", "startIso": "string", "spokenLabel": "string", "specialist": "string", "appointmentType": "string", "durationMin": 0, "price": "string", "location": { "name": "string", "address": "string" }, "instructions": "string", "status": "string", "contactId": "b5ec5d98-4bee-4da1-ad24-dde86346cb1d" } ]}Move any appointment (staff and partner keys) POST
`expectedVersion` is required: a mismatch answers `SCHEDULING_STALE_VERSION` (409) instead of overwriting a change you never read. **202** is a success: `{ data: { operationId, status } }` where `status` is `PENDING` or `UNCERTAIN` — poll, do NOT retry. Required scope: `scheduling.manage`.
Book an appointment POST
Pass `slotToken` or `holdId`, and `patientRef` (from /patients/lookup) or `patient`. **202** means the outcome is not yet known: the body carries an `operationId` — poll GET /scheduling/booking-operations/{operationId} and do NOT re-POST, which risks a second appointment. `idempotencyKey` is optional and exists for retries: reusing a key MUST repeat the identical request — a different body under a used key is refused with `SCHEDULING_IDEMPOTENCY_MISMATCH` (409) and books nothing. Booking with a `holdId` REQUIRES the same `X-Mediflo-Scheduling-Session` value you created the hold with: a hold belongs to the request that made it, so without the header this request is a different owner and the booking answers `SLOT_TAKEN` on the slot you are holding. Booking straight from a `slotToken` needs no hold and no header. Required scope: `scheduling.book`.