bookingAPI-Referenz

POST/v2/booking

Buchung für einen bestehenden Kunden erstellen

Erstellt genau eine Buchung für owner und offer. Die gewählte oder standardmässige Preiskategorie, Wartelistenfähigkeit, Mitgliedschaft und Kapazität werden im Konto geprüft; eine Buchung kann Abrechnung und weitere Buchungsfolgen auslösen. noreturn=true lässt die erweiterten Rückgaben booking und booking_data weg. Die bereits geprüften Aktionsschemas beschreiben die unterstützten Varianten.

Operation-ID post_v2_booking

Vertrag & Verhalten

Dokumentationsstand: reviewed
Ändert Zustand: Ja
Als readOnly markiert: Nein
Für Automation markiert: Nein

Authentifizierung

Eine der folgenden Alternativen muss erfüllt sein (ODER). Innerhalb jeder Alternative werden alle angegebenen Schemas gemeinsam benötigt (UND).

Alternative 1

bearerAuthhttp · bearer

Existing edoobox v2 access token. Never substitute API key/secret headers.

Format: JWT

Security-Schema als JSON

{
  "type": "http",
  "scheme": "bearer",
  "bearerFormat": "JWT",
  "description": "Existing edoobox v2 access token. Never substitute API key/secret headers."
}

accountContextapiKey

Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account.

header: edid

Security-Schema als JSON

{
  "type": "apiKey",
  "in": "header",
  "name": "edid",
  "description": "Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account."
}

Alternative 2

sessionCookieapiKey

Existing browser login session, with the same permission checks as Bearer authentication.

cookie: _edlogin

Security-Schema als JSON

{
  "type": "apiKey",
  "in": "cookie",
  "name": "_edlogin",
  "description": "Existing browser login session, with the same permission checks as Bearer authentication."
}

accountContextapiKey

Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account.

header: edid

Security-Schema als JSON

{
  "type": "apiKey",
  "in": "header",
  "name": "edid",
  "description": "Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account."
}

Berechtigungen

Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope.

Ressource: booking · book
Levels: 2, 3, 4
Dispatcher-Prüfung: Ja

Parameter

Header

languageoptional

Account language code, where the resource supports setLanguage().

string

Schema-Beispiel

"de"

Vollständiges Schema als JSON

{
  "type": "string",
  "examples": [
    "de"
  ]
}

X-Edoobox-If-Revisionoptional

Optional account mutation revision from a preceding authenticated auth-context snapshot. The dispatcher compares it while holding the account lock; mismatch409 requires a new review.

string

pattern: "^[a-f0-9]{32}$"

Schema-Beispiel

"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"

Vollständiges Schema als JSON

{
  "type": "string",
  "pattern": "^[a-f0-9]{32}$",
  "examples": [
    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
  ]
}

Request Body

erforderlich

`application/json`

object

data object erforderlich

Create one booking for an existing owner and offer. Unknown fields remain open because the legacy hook tolerates additional client context.

offer string erforderlich

Existing offer in the selected account; required by the native booking-create hook. Existing opaque offer v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.

pattern: "^offer_[a-f0-9]{12}_-?[0-9]+$"

Schema-Beispiel

"offer_012345abcdef_123456"

Feld-Metadaten aus der Spezifikation

{
  "x-edoobox-sourceLine": 43
}

owner string erforderlich

Existing booking owner (user v2 ID); required for booking creation, immutable on ordinary update. Existing opaque user v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.

pattern: "^user_[a-f0-9]{12}_-?[0-9]+$"

Schema-Beispiel

"user_012345abcdef_123456"

Feld-Metadaten aus der Spezifikation

{
  "x-edoobox-sourceLine": 58
}

waiting_list Typ nicht eingeschränkt beim Ändern nicht schreibbar

Create as a waiting-list booking; lesson-based offers reject this mode in Bookingfunc::_addBooking.

Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.

PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.

Schema-Beispiel

false

Feld-Metadaten aus der Spezifikation

{
  "x-edoobox-writableOnUpdate": false,
  "x-edoobox-schemaStatus": "source-inferred",
  "x-edoobox-sourceLine": 93,
  "x-edoobox-canonicalType": "boolean",
  "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction."
}

pricecategory Typ nicht eingeschränkt

Optional explicit price selection. False, null and empty text use the native edisset/default-price path; the existing Vue booking form can submit an empty price selection.

anyOf · Mindestens eine Variante muss passen

Variante 1 string

Existing opaque pricecategory v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.

pattern: "^pricecategory_[a-f0-9]{12}_-?[0-9]+$"

Schema-Beispiel

"pricecategory_012345abcdef_123456"

Variante 2 Typ nicht eingeschränkt

Erlaubte Werte

falsenull""

Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.

noreturn Typ nicht eingeschränkt

PHP loose comparison controls whether booking_data and booking readback are appended; true omits the expensive expanded readback.

Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.

Feld-Metadaten aus der Spezifikation

{
  "x-edoobox-canonicalType": "boolean"
}

Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.

Vollständiges Schema als JSON

{
  "type": "object",
  "required": [
    "data"
  ],
  "properties": {
    "data": {
      "type": "object",
      "properties": {
        "offer": {
          "type": "string",
          "pattern": "^offer_[a-f0-9]{12}_-?[0-9]+$",
          "description": "Existing offer in the selected account; required by the native booking-create hook.\n\nExisting opaque offer v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
          "examples": [
            "offer_012345abcdef_123456"
          ],
          "x-edoobox-sourceLine": 43
        },
        "owner": {
          "type": "string",
          "pattern": "^user_[a-f0-9]{12}_-?[0-9]+$",
          "description": "Existing booking owner (user v2 ID); required for booking creation, immutable on ordinary update.\n\nExisting opaque user v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
          "examples": [
            "user_012345abcdef_123456"
          ],
          "x-edoobox-sourceLine": 58
        },
        "waiting_list": {
          "x-edoobox-writableOnUpdate": false,
          "x-edoobox-schemaStatus": "source-inferred",
          "x-edoobox-sourceLine": 93,
          "x-edoobox-canonicalType": "boolean",
          "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
          "examples": [
            false
          ],
          "description": "Create as a waiting-list booking; lesson-based offers reject this mode in Bookingfunc::_addBooking."
        },
        "pricecategory": {
          "anyOf": [
            {
              "type": "string",
              "pattern": "^pricecategory_[a-f0-9]{12}_-?[0-9]+$",
              "description": "Existing opaque pricecategory v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
              "examples": [
                "pricecategory_012345abcdef_123456"
              ]
            },
            {
              "enum": [
                false,
                null,
                ""
              ]
            }
          ],
          "description": "Optional explicit price selection. False, null and empty text use the native edisset/default-price path; the existing Vue booking form can submit an empty price selection."
        }
      },
      "additionalProperties": true,
      "description": "Create one booking for an existing owner and offer. Unknown fields remain open because the legacy hook tolerates additional client context.",
      "required": [
        "offer",
        "owner"
      ]
    },
    "noreturn": {
      "x-edoobox-canonicalType": "boolean",
      "description": "PHP loose comparison controls whether booking_data and booking readback are appended; true omits the expensive expanded readback."
    }
  },
  "additionalProperties": true
}

Synthetic supported request; replace all IDs with values read from this account.

{
  "data": {
    "owner": "user_012345abcdef_123456",
    "offer": "offer_012345abcdef_123456"
  }
}

Synthetic supported request; replace all IDs with values read from this account.

{
  "data": {
    "owner": "user_012345abcdef_123456",
    "offer": "offer_012345abcdef_123456",
    "pricecategory": "pricecategory_012345abcdef_123456",
    "waiting_list": false
  }
}

Synthetic supported request; replace all IDs with values read from this account.

{
  "data": {
    "owner": "user_012345abcdef_123456",
    "offer": "offer_012345abcdef_123456",
    "waiting_list": true
  }
}

Existing client empty-selection variant chooses the native default price.

{
  "data": {
    "owner": "user_012345abcdef_123456",
    "offer": "offer_012345abcdef_123456",
    "pricecategory": ""
  }
}

Antworten

HTTP-Status und Antwortinhalt gemeinsam auswerten. In dieser API können auch Antworten mit HTTP 200 einen Fehler enthalten.

200application/json

Response; inspect error and success as legacy failures may also use HTTP 200.

Response Header

`X-Edoobox-Revision`

Rotated account revision supplied for the next action in one reviewed sequence.

string

pattern: "^[a-f0-9]{32}$"

Vollständiges Schema als JSON

{
  "type": "string",
  "pattern": "^[a-f0-9]{32}$"
}

`application/json`

object

success boolean

error boolean | string

error_code string

data object

insert boolean

id string

Existing opaque booking v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.

pattern: "^booking_[a-f0-9]{12}_-?[0-9]+$"

Schema-Beispiel

"booking_012345abcdef_123456"

participant Typ nicht eingeschränkt

anyOf · Mindestens eine Variante muss passen

Variante 1 string

Existing opaque participant v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.

pattern: "^participant_[a-f0-9]{12}_-?[0-9]+$"

Schema-Beispiel

"participant_012345abcdef_123456"

Variante 2 Typ nicht eingeschränkt

Fester Wert: false

position Typ nicht eingeschränkt

Fester Wert: "person"

booking_data object

Dynamic expanded booking view, included unless noreturn is true.

Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.

booking object

Dynamic source Structure readback, included unless noreturn is true.

Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.

type string

Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.

Vollständiges Schema als JSON

{
  "type": "object",
  "properties": {
    "success": {
      "type": "boolean"
    },
    "error": {
      "type": [
        "boolean",
        "string"
      ]
    },
    "error_code": {
      "type": "string"
    },
    "data": {
      "type": "object",
      "properties": {
        "insert": {
          "type": "boolean"
        },
        "id": {
          "type": "string",
          "pattern": "^booking_[a-f0-9]{12}_-?[0-9]+$",
          "description": "Existing opaque booking v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
          "examples": [
            "booking_012345abcdef_123456"
          ]
        },
        "participant": {
          "anyOf": [
            {
              "type": "string",
              "pattern": "^participant_[a-f0-9]{12}_-?[0-9]+$",
              "description": "Existing opaque participant v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
              "examples": [
                "participant_012345abcdef_123456"
              ]
            },
            {
              "const": false
            }
          ]
        },
        "position": {
          "const": "person"
        },
        "booking_data": {
          "type": "object",
          "properties": {},
          "additionalProperties": true,
          "description": "Dynamic expanded booking view, included unless noreturn is true."
        },
        "booking": {
          "type": "object",
          "properties": {},
          "additionalProperties": true,
          "description": "Dynamic source Structure readback, included unless noreturn is true."
        }
      },
      "additionalProperties": true
    },
    "type": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

created

{
  "error": false,
  "type": "booking",
  "data": {
    "insert": true,
    "id": "booking_012345abcdef_123456",
    "participant": "participant_012345abcdef_123456",
    "position": "person"
  }
}

missingOwner

{
  "error": "ED80100",
  "type": "booking",
  "require": {
    "owner": false,
    "offer": false
  }
}

invalidPrice

{
  "error": "ED80100",
  "error_code": "invalid_pricecategory",
  "type": "booking"
}

400application/json

Invalid request.

`application/json`

Typ nicht eingeschränkt

Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.

Beispiel

{
  "success": false,
  "error": "ED40006"
}

401application/json

Missing/expired token, missing account context, account paused or model-specific authorization failure.

`application/json`

Typ nicht eingeschränkt

Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.

Beispiel

{
  "success": false,
  "error": "ED40103"
}

402application/json

Missing/invalid action data or subscription/operation restriction.

`application/json`

Typ nicht eingeschränkt

Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.

Beispiel

{
  "success": false,
  "error": "ED80100"
}

403application/json

Permission denied. Browser CORS rejection may have an empty body.

`application/json`

Typ nicht eingeschränkt

Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.

Beispiel

{
  "success": false,
  "error": "ED40340"
}

404application/json

Unknown resource/action or unsupported method.

`application/json`

Typ nicht eingeschränkt

Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.

Beispiel

{
  "success": false,
  "error": "ED80019"
}

409application/json

The account changed after the reviewed read. No domain operation is dispatched; obtain fresh state and review again.

`application/json`

object

Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.

Vollständiges Schema als JSON

{
  "type": "object",
  "additionalProperties": true
}

Beispiel

{
  "error": "ED40901",
  "error_code": "mutation_revision_conflict"
}

422application/json

Validation failed.

`application/json`

Typ nicht eingeschränkt

Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.

Beispiel

{
  "success": false,
  "error": "ED80020"
}

429application/json

Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.

Response Header

`Retry-After`

Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.

string

Schema-Beispiel

"30"

Vollständiges Schema als JSON

{
  "type": "string",
  "examples": [
    "30"
  ]
}

`application/json`

Typ nicht eingeschränkt

Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.

Beispiel

{
  "success": false,
  "error": "ED42902"
}

502application/json

Server-side operation failed.

`application/json`

Typ nicht eingeschränkt

Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.

Beispiel

{
  "success": false,
  "error": "ED50201"
}

503application/json

The account mutation lock or revision store is unavailable. No unprotected fallback is executed.

Response Header

`application/json`

object

Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.

Vollständiges Schema als JSON

{
  "type": "object",
  "additionalProperties": true
}

Beispiel

{
  "error": "ED50301",
  "error_code": "mutation_revision_busy"
}

Quelle & Metadaten

Quelle laut Spezifikationapplication/models/v2/Booking.php:170postBooking()

Diese Angaben stammen unverändert aus der gelieferten OpenAPI-Datei. Zusätzliche Freigaben, Vorbedingungen, sensible Felder und Hinweise stehen in den Erweiterungen.

x-edoobox-mutates-state

true

x-edoobox-action-contract

{
  "review": "booking-create",
  "status": "source-reviewed-partial",
  "sources": [
    {
      "file": "application/models/v2/Booking.php",
      "sha256": "78bb2e6d2875243f1267a8724ab29e406b7c93dd351c50f6a270f9c184ae81b5",
      "methods": [
        "__construct",
        "postBooking"
      ]
    },
    {
      "file": "application/models/v2/Bookingfunc.php",
      "sha256": "de555a91da81398e3402d431d1dbda26eb1bc17019b2e44f17e854ced79762b7",
      "methods": [
        "_addBooking"
      ]
    },
    {
      "file": "application/helpers/edooboxhelp_helper.php",
      "sha256": "090d351b5bde81813c7a829bedf2f1f9f978fce5765f246989779f996198934e",
      "symbols": [
        "edisset"
      ],
      "reason": "Falsy optional price selections fall through to the default-price lookup."
    }
  ],
  "preconditions": [
    "Owner and offer must exist in the selected account. Child offers resolve through their parent booking.",
    "A matching explicit price or exactly one active default price must be available; a missing/nonmatching explicit selection can fall back to the default.",
    "Waiting-list bookings cannot be created for lesson-based offers. Membership eligibility, balance reservation and invoicing run in the native hook."
  ],
  "errors": [
    {
      "error": "ED80100",
      "meaning": "Missing/invalid owner or failed native write/lock."
    },
    {
      "error": "ED80020",
      "meaning": "Owner/offer relation or parent offer was not found in this account."
    },
    {
      "error": "ED80100",
      "error_code": "invalid_pricecategory",
      "meaning": "No usable default price could be selected."
    },
    {
      "error": "ED90030",
      "meaning": "Waiting-list mode conflicts with lesson-based registration."
    }
  ],
  "unresolved": [
    "Database existence, signed ID integrity, membership eligibility, dynamic price/account settings and downstream side effects remain native checks.",
    "Expanded booking_data and booking responses are intentionally open.",
    "The native early Require_Data guard repeats owner; offer is nevertheless consumed and checked by the subsequent account-scoped offer query. This contract does not claim that early guard validates both fields."
  ]
}

x-edoobox-runtimeMutationGuard

true

x-edoobox-documentationReview

{
  "file": "docs/openapi/operation-contracts/02-booking-users.json",
  "notes": []
}

x-edoobox-source

{
  "file": "application/models/v2/Booking.php",
  "method": "postBooking",
  "line": 170
}

x-edoobox-documentationStatus

"reviewed"

x-edoobox-readOnly

false

x-edoobox-safeForAutomation

false

x-edoobox-permission

{
  "resource": "booking",
  "short": "book",
  "checkedByDispatcher": true,
  "levels": [
    2,
    3,
    4
  ],
  "description": "Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope."
}

Vollständige Operation als JSON

{
  "operationId": "post_v2_booking",
  "summary": "Buchung für einen bestehenden Kunden erstellen",
  "description": "Erstellt genau eine Buchung für owner und offer. Die gewählte oder standardmässige Preiskategorie, Wartelistenfähigkeit, Mitgliedschaft und Kapazität werden im Konto geprüft; eine Buchung kann Abrechnung und weitere Buchungsfolgen auslösen. noreturn=true lässt die erweiterten Rückgaben booking und booking_data weg. Die bereits geprüften Aktionsschemas beschreiben die unterstützten Varianten.",
  "tags": [
    "booking"
  ],
  "security": [
    {
      "bearerAuth": [],
      "accountContext": []
    },
    {
      "sessionCookie": [],
      "accountContext": []
    }
  ],
  "parameters": [
    {
      "name": "language",
      "in": "header",
      "required": false,
      "description": "Account language code, where the resource supports setLanguage().",
      "schema": {
        "type": "string",
        "examples": [
          "de"
        ]
      }
    },
    {
      "name": "X-Edoobox-If-Revision",
      "in": "header",
      "required": false,
      "schema": {
        "type": "string",
        "pattern": "^[a-f0-9]{32}$",
        "examples": [
          "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        ]
      },
      "description": "Optional account mutation revision from a preceding authenticated auth-context snapshot. The dispatcher compares it while holding the account lock; mismatch409 requires a new review."
    }
  ],
  "responses": {
    "200": {
      "description": "Response; inspect error and success as legacy failures may also use HTTP 200.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "success": {
                "type": "boolean"
              },
              "error": {
                "type": [
                  "boolean",
                  "string"
                ]
              },
              "error_code": {
                "type": "string"
              },
              "data": {
                "type": "object",
                "properties": {
                  "insert": {
                    "type": "boolean"
                  },
                  "id": {
                    "type": "string",
                    "pattern": "^booking_[a-f0-9]{12}_-?[0-9]+$",
                    "description": "Existing opaque booking v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
                    "examples": [
                      "booking_012345abcdef_123456"
                    ]
                  },
                  "participant": {
                    "anyOf": [
                      {
                        "type": "string",
                        "pattern": "^participant_[a-f0-9]{12}_-?[0-9]+$",
                        "description": "Existing opaque participant v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
                        "examples": [
                          "participant_012345abcdef_123456"
                        ]
                      },
                      {
                        "const": false
                      }
                    ]
                  },
                  "position": {
                    "const": "person"
                  },
                  "booking_data": {
                    "type": "object",
                    "properties": {},
                    "additionalProperties": true,
                    "description": "Dynamic expanded booking view, included unless noreturn is true."
                  },
                  "booking": {
                    "type": "object",
                    "properties": {},
                    "additionalProperties": true,
                    "description": "Dynamic source Structure readback, included unless noreturn is true."
                  }
                },
                "additionalProperties": true
              },
              "type": {
                "type": "string"
              }
            },
            "additionalProperties": true
          },
          "examples": {
            "created": {
              "value": {
                "error": false,
                "type": "booking",
                "data": {
                  "insert": true,
                  "id": "booking_012345abcdef_123456",
                  "participant": "participant_012345abcdef_123456",
                  "position": "person"
                }
              }
            },
            "missingOwner": {
              "value": {
                "error": "ED80100",
                "type": "booking",
                "require": {
                  "owner": false,
                  "offer": false
                }
              }
            },
            "invalidPrice": {
              "value": {
                "error": "ED80100",
                "error_code": "invalid_pricecategory",
                "type": "booking"
              }
            }
          }
        }
      },
      "headers": {
        "X-Edoobox-Revision": {
          "schema": {
            "type": "string",
            "pattern": "^[a-f0-9]{32}$"
          },
          "description": "Rotated account revision supplied for the next action in one reviewed sequence."
        }
      }
    },
    "400": {
      "description": "Invalid request.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40006"
          }
        }
      }
    },
    "401": {
      "description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40103"
          }
        }
      }
    },
    "402": {
      "description": "Missing/invalid action data or subscription/operation restriction.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80100"
          }
        }
      }
    },
    "403": {
      "description": "Permission denied. Browser CORS rejection may have an empty body.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40340"
          }
        }
      }
    },
    "404": {
      "description": "Unknown resource/action or unsupported method.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80019"
          }
        }
      }
    },
    "409": {
      "description": "The account changed after the reviewed read. No domain operation is dispatched; obtain fresh state and review again.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "additionalProperties": true
          },
          "example": {
            "error": "ED40901",
            "error_code": "mutation_revision_conflict"
          }
        }
      }
    },
    "422": {
      "description": "Validation failed.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80020"
          }
        }
      }
    },
    "429": {
      "description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED42902"
          }
        }
      },
      "headers": {
        "Retry-After": {
          "description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.",
          "schema": {
            "type": "string",
            "examples": [
              "30"
            ]
          }
        }
      }
    },
    "502": {
      "description": "Server-side operation failed.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED50201"
          }
        }
      }
    },
    "503": {
      "description": "The account mutation lock or revision store is unavailable. No unprotected fallback is executed.",
      "headers": {
        "Retry-After": {
          "schema": {
            "type": "integer",
            "const": 1
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "additionalProperties": true
          },
          "example": {
            "error": "ED50301",
            "error_code": "mutation_revision_busy"
          }
        }
      }
    }
  },
  "x-edoobox-mutates-state": true,
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "required": [
            "data"
          ],
          "properties": {
            "data": {
              "type": "object",
              "properties": {
                "offer": {
                  "type": "string",
                  "pattern": "^offer_[a-f0-9]{12}_-?[0-9]+$",
                  "description": "Existing offer in the selected account; required by the native booking-create hook.\n\nExisting opaque offer v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
                  "examples": [
                    "offer_012345abcdef_123456"
                  ],
                  "x-edoobox-sourceLine": 43
                },
                "owner": {
                  "type": "string",
                  "pattern": "^user_[a-f0-9]{12}_-?[0-9]+$",
                  "description": "Existing booking owner (user v2 ID); required for booking creation, immutable on ordinary update.\n\nExisting opaque user v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
                  "examples": [
                    "user_012345abcdef_123456"
                  ],
                  "x-edoobox-sourceLine": 58
                },
                "waiting_list": {
                  "x-edoobox-writableOnUpdate": false,
                  "x-edoobox-schemaStatus": "source-inferred",
                  "x-edoobox-sourceLine": 93,
                  "x-edoobox-canonicalType": "boolean",
                  "x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
                  "examples": [
                    false
                  ],
                  "description": "Create as a waiting-list booking; lesson-based offers reject this mode in Bookingfunc::_addBooking."
                },
                "pricecategory": {
                  "anyOf": [
                    {
                      "type": "string",
                      "pattern": "^pricecategory_[a-f0-9]{12}_-?[0-9]+$",
                      "description": "Existing opaque pricecategory v2 ID from the selected account. The native action checks account/resource relations; a syntactically matching synthetic ID does not establish existence.",
                      "examples": [
                        "pricecategory_012345abcdef_123456"
                      ]
                    },
                    {
                      "enum": [
                        false,
                        null,
                        ""
                      ]
                    }
                  ],
                  "description": "Optional explicit price selection. False, null and empty text use the native edisset/default-price path; the existing Vue booking form can submit an empty price selection."
                }
              },
              "additionalProperties": true,
              "description": "Create one booking for an existing owner and offer. Unknown fields remain open because the legacy hook tolerates additional client context.",
              "required": [
                "offer",
                "owner"
              ]
            },
            "noreturn": {
              "x-edoobox-canonicalType": "boolean",
              "description": "PHP loose comparison controls whether booking_data and booking readback are appended; true omits the expensive expanded readback."
            }
          },
          "additionalProperties": true
        },
        "examples": {
          "minimal": {
            "summary": "Synthetic supported request; replace all IDs with values read from this account.",
            "value": {
              "data": {
                "owner": "user_012345abcdef_123456",
                "offer": "offer_012345abcdef_123456"
              }
            }
          },
          "selectedPrice": {
            "summary": "Synthetic supported request; replace all IDs with values read from this account.",
            "value": {
              "data": {
                "owner": "user_012345abcdef_123456",
                "offer": "offer_012345abcdef_123456",
                "pricecategory": "pricecategory_012345abcdef_123456",
                "waiting_list": false
              }
            }
          },
          "waitingList": {
            "summary": "Synthetic supported request; replace all IDs with values read from this account.",
            "value": {
              "data": {
                "owner": "user_012345abcdef_123456",
                "offer": "offer_012345abcdef_123456",
                "waiting_list": true
              }
            }
          },
          "defaultPrice": {
            "summary": "Existing client empty-selection variant chooses the native default price.",
            "value": {
              "data": {
                "owner": "user_012345abcdef_123456",
                "offer": "offer_012345abcdef_123456",
                "pricecategory": ""
              }
            }
          }
        }
      }
    }
  },
  "x-edoobox-action-contract": {
    "review": "booking-create",
    "status": "source-reviewed-partial",
    "sources": [
      {
        "file": "application/models/v2/Booking.php",
        "sha256": "78bb2e6d2875243f1267a8724ab29e406b7c93dd351c50f6a270f9c184ae81b5",
        "methods": [
          "__construct",
          "postBooking"
        ]
      },
      {
        "file": "application/models/v2/Bookingfunc.php",
        "sha256": "de555a91da81398e3402d431d1dbda26eb1bc17019b2e44f17e854ced79762b7",
        "methods": [
          "_addBooking"
        ]
      },
      {
        "file": "application/helpers/edooboxhelp_helper.php",
        "sha256": "090d351b5bde81813c7a829bedf2f1f9f978fce5765f246989779f996198934e",
        "symbols": [
          "edisset"
        ],
        "reason": "Falsy optional price selections fall through to the default-price lookup."
      }
    ],
    "preconditions": [
      "Owner and offer must exist in the selected account. Child offers resolve through their parent booking.",
      "A matching explicit price or exactly one active default price must be available; a missing/nonmatching explicit selection can fall back to the default.",
      "Waiting-list bookings cannot be created for lesson-based offers. Membership eligibility, balance reservation and invoicing run in the native hook."
    ],
    "errors": [
      {
        "error": "ED80100",
        "meaning": "Missing/invalid owner or failed native write/lock."
      },
      {
        "error": "ED80020",
        "meaning": "Owner/offer relation or parent offer was not found in this account."
      },
      {
        "error": "ED80100",
        "error_code": "invalid_pricecategory",
        "meaning": "No usable default price could be selected."
      },
      {
        "error": "ED90030",
        "meaning": "Waiting-list mode conflicts with lesson-based registration."
      }
    ],
    "unresolved": [
      "Database existence, signed ID integrity, membership eligibility, dynamic price/account settings and downstream side effects remain native checks.",
      "Expanded booking_data and booking responses are intentionally open.",
      "The native early Require_Data guard repeats owner; offer is nevertheless consumed and checked by the subsequent account-scoped offer query. This contract does not claim that early guard validates both fields."
    ]
  },
  "x-edoobox-runtimeMutationGuard": true,
  "x-edoobox-documentationReview": {
    "file": "docs/openapi/operation-contracts/02-booking-users.json",
    "notes": []
  },
  "x-edoobox-source": {
    "file": "application/models/v2/Booking.php",
    "method": "postBooking",
    "line": 170
  },
  "x-edoobox-documentationStatus": "reviewed",
  "x-edoobox-readOnly": false,
  "x-edoobox-safeForAutomation": false,
  "x-edoobox-permission": {
    "resource": "booking",
    "short": "book",
    "checkedByDispatcher": true,
    "levels": [
      2,
      3,
      4
    ],
    "description": "Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope."
  }
}

Aufruf vorbereiten

Beispiel

Platzhalter ersetzen und Vertragsangaben prüfen. Die Beispiele werden hier nicht ausgeführt.

cURL

# Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
# Request Body: synthetisches Beispiel aus der Spezifikation; Werte und Vollständigkeit vor Verwendung prüfen.
: "${API_ORIGIN:?API_ORIGIN setzen}"
: "${AUTH_BEARERAUTH:?AUTH_BEARERAUTH setzen}"
: "${AUTH_ACCOUNTCONTEXT:?AUTH_ACCOUNTCONTEXT setzen}"
cat > payload.json <<'EDOOBOX_JSON_EXAMPLE'
{
  "data": {
    "owner": "user_012345abcdef_123456",
    "offer": "offer_012345abcdef_123456"
  }
}
EDOOBOX_JSON_EXAMPLE
curl --request 'POST' \
  --url "${API_ORIGIN%/}"'/v2/booking' \
  --header 'Authorization: Bearer '"${AUTH_BEARERAUTH}" \
  --header 'edid: '"${AUTH_ACCOUNTCONTEXT}" \
  --header 'Content-Type: application/json' \
  --data-binary '@payload.json'

JavaScript

// Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
// Request Body: synthetisches Beispiel aus der Spezifikation; Werte und Vollständigkeit vor Verwendung prüfen.
const required = (name) => {
  const value = process.env[name];
  if (!value) throw new Error(`Set ${name}`);
  return value;
};
let path = "/v2/booking";
const origin = required('API_ORIGIN');
const url = new URL((origin.endsWith('/') ? origin.slice(0, -1) : origin) + path);
const headers = {};
headers["Authorization"] = "Bearer " + required("AUTH_BEARERAUTH");
headers["edid"] = "" + required("AUTH_ACCOUNTCONTEXT");
headers['Content-Type'] = "application/json";
const body = JSON.stringify({
  "data": {
    "owner": "user_012345abcdef_123456",
    "offer": "offer_012345abcdef_123456"
  }
});
const response = await fetch(url, { method: "POST", headers, body, redirect: 'manual' });
const text = await response.text();
console.log(response.status, text);
// HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen.

Python

# Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
# Request Body: synthetisches Beispiel aus der Spezifikation; Werte und Vollständigkeit vor Verwendung prüfen.
import os
import urllib.parse
import urllib.request
import urllib.error

path = "/v2/booking"
url = os.environ["API_ORIGIN"].rstrip("/") + path
headers = {}
headers["Authorization"] = "Bearer " + os.environ["AUTH_BEARERAUTH"]
headers["edid"] = "" + os.environ["AUTH_ACCOUNTCONTEXT"]
headers["Content-Type"] = "application/json"
body = "{\"data\":{\"owner\":\"user_012345abcdef_123456\",\"offer\":\"offer_012345abcdef_123456\"}}".encode("utf-8")

# Redirects nicht automatisch verfolgen.
class NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None
request = urllib.request.Request(url, headers=headers, method="POST", data=body)
try:
    response = urllib.request.build_opener(NoRedirect).open(request, timeout=30)
except urllib.error.HTTPError as error:
    response = error
print(response.status, response.read().decode("utf-8", errors="replace"))
# HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen.

Ohne JavaScript können Sie die weiteren Aufrufbeispiele hier aufklappen und den Code manuell kopieren.

JavaScript

// Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
// Request Body: synthetisches Beispiel aus der Spezifikation; Werte und Vollständigkeit vor Verwendung prüfen.
const required = (name) => {
  const value = process.env[name];
  if (!value) throw new Error(`Set ${name}`);
  return value;
};
let path = "/v2/booking";
const origin = required('API_ORIGIN');
const url = new URL((origin.endsWith('/') ? origin.slice(0, -1) : origin) + path);
const headers = {};
headers["Authorization"] = "Bearer " + required("AUTH_BEARERAUTH");
headers["edid"] = "" + required("AUTH_ACCOUNTCONTEXT");
headers['Content-Type'] = "application/json";
const body = JSON.stringify({
  "data": {
    "owner": "user_012345abcdef_123456",
    "offer": "offer_012345abcdef_123456"
  }
});
const response = await fetch(url, { method: "POST", headers, body, redirect: 'manual' });
const text = await response.text();
console.log(response.status, text);
// HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen.

Python

# Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
# Request Body: synthetisches Beispiel aus der Spezifikation; Werte und Vollständigkeit vor Verwendung prüfen.
import os
import urllib.parse
import urllib.request
import urllib.error

path = "/v2/booking"
url = os.environ["API_ORIGIN"].rstrip("/") + path
headers = {}
headers["Authorization"] = "Bearer " + os.environ["AUTH_BEARERAUTH"]
headers["edid"] = "" + os.environ["AUTH_ACCOUNTCONTEXT"]
headers["Content-Type"] = "application/json"
body = "{\"data\":{\"owner\":\"user_012345abcdef_123456\",\"offer\":\"offer_012345abcdef_123456\"}}".encode("utf-8")

# Redirects nicht automatisch verfolgen.
class NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None
request = urllib.request.Request(url, headers=headers, method="POST", data=body)
try:
    response = urllib.request.build_opener(NoRedirect).open(request, timeout=30)
except urllib.error.HTTPError as error:
    response = error
print(response.status, response.read().decode("utf-8", errors="replace"))
# HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen.

Server aus der Spezifikation

https://app2.edoobox.com

edoobox API

Verwenden Sie die für Ihre Integration bestätigte API-Basis-URL. Ein lokaler Entwicklungsserver ist keine Produktionsadresse.

Als Markdown lesenEin Endpunkt. Vollständig. Für Menschen und LLM.