REST API & Developer Portal — Animal Friends OS

What you can build

Real things real operators have built.

Custom dashboards

Pull live booking, revenue, and staff data into your own BI tools (Looker Studio, Metabase, Power BI). Refresh every 5 minutes if you want.

Third-party integrations

Push data into your accounting, marketing automation, or loyalty platform. Anything that speaks HTTP can talk to your facility.

Webhooks for any event

Subscribe to bookings, check-ins, payments, cancellations. Trigger Slack messages, email automations, or downstream systems in real time.

Mobile apps and kiosks

Build a self-check-in kiosk for your lobby, a staff app for the back, or a custom client app. Full create/read/update access.

Endpoint coverage

What the API can do.

A non-exhaustive list. Full reference is in your developer portal once your account is provisioned.

Clients & Pets

GET /api/v1/clients — list, filter, paginate
POST /api/v1/clients — create with pets and contact info
GET /api/v1/pets — pets attached to a client
PATCH /api/pets/:id — update vaccinations, breed notes, photos

Bookings

GET /api/v1/bookings — with filters by date, service, status
POST /api/v1/bookings — create a grooming, boarding, daycare, or training booking
PATCH /api/bookings/:id — reschedule, change staff, change services
GET /api/v1/bookings/:id — cancel with reason and refund logic

Payments & Invoicing

GET /api/v1/invoices — create from line items
GET /api/v1/invoices/:id — charge against your own processor
GET /api/v1/staff — reconcile against deposits

Reports

GET /api/v1/reports/revenue — daily, weekly, monthly with breakdowns
GET /api/v1/reports/summary — who is doing what
POST /api/v1/sms/send — volume per service line

Webhooks

booking.created · booking.updated · booking.cancelled
checkin.completed · checkout.completed
payment.succeeded · payment.failed
client.created · pet.vaccination.updated

How auth works

API keys + webhooks. Simple.

Generate API keys in your developer portal. Pass them as a Bearer token. Webhook signatures use HMAC SHA-256. Standard stuff — no surprises.

curl -H "Authorization: Bearer YOUR_API_KEY" \
     https://api.animalfriendsos.app/api/bookings?date=2026-05-01

// Webhook signature verification (Node.js)
const crypto = require('crypto');
const sig = req.headers['x-afos-signature'];
const expected = crypto.createHmac('sha256', WEBHOOK_SECRET)
                       .update(req.rawBody)
                       .digest('hex');
if (sig !== expected) return res.status(401).send('Invalid signature');

Rate limits + reliability

Generous limits. Honest behavior.

Default rate limit	1,000 requests/minute per API key
Burst allowance	2,000 requests/minute for short bursts
Pagination	Cursor-based, 100 items per page
Idempotency	`Idempotency-Key` header on all `POST` requests
Versioning	`x-afos-version` header. Breaking changes get 6 months notice.
Webhook retries	Up to 24 hours with exponential backoff if your endpoint returns non-2xx

REST API. Documented. Included.