REST API v1 — https://api.openlagoon.com/api/v1
Every request (except GET /health and POST /tenants/register) requires your API key in the X-API-Key header.
curl -H "X-API-Key: YOUR_API_KEY" https://api.openlagoon.com/api/v1/rooms
All responses are JSON: {"success": true|false, "message": "...", "data": ...}
Create video meeting rooms and mint join tokens for your users. Temporary rooms expire 8 hours after creation; scheduled rooms at end_time; persistent rooms never.
/rooms{
"name": "Strategy call", // required
"room_type": "temporary", // temporary | scheduled | persistent
"max_participants": 10,
"access_type": "public", // public | password | whitelist
"recording_enabled": false,
"chat_enabled": true,
"waiting_room_enabled": false,
"start_time": "2026-06-10 15:00:00", // scheduled rooms
"end_time": "2026-06-10 16:00:00"
}
// → { "data": { "id": "42", "room_id": "AbC123XyZ", "url": "https://dash.openlagoon.com/room/AbC123XyZ" } }
/rooms — list your rooms/rooms/{id} — fetch one (numeric id or room_id)/rooms/{id} — update settings/rooms/{id} — delete (soft)/rooms/{id}/token{ "participant_name": "Ada", "can_publish": true, "can_subscribe": true }
// → { "data": { "token": "<livekit-jwt>", "room_id": "AbC123XyZ", "url": "..." } }
Pass password for password rooms. Use the token with the LiveKit client SDK, or just send users to the room url.
/rooms/{id}/validate-access — pre-check a participant's access/rooms/{id}/recording/start/rooms/{id}/recording/stop/rooms/{id}/recording/status/recordings — list/recordings/{id} — detail/recordings/{id}Recording must be enabled on the room (recording_enabled: true). Subscribe to the recording.ready webhook to know when playback is available.
Read your booking system (session types, live slot availability, bookings) and cancel bookings. Bookings are created by guests through your public booking pages.
/scheduling/types — session types with booking URLs, schedules, access levels/scheduling/types/{id}/slots — bookable slots (?from=YYYY-MM-DD optional)// → { "data": { "timezone": "America/New_York", "duration_minutes": 30,
// "slots": [ { "start": "2026-06-10T14:00:00+00:00", "end": "...", "start_host": "2026-06-10 10:00" } ] } }
/scheduling/bookings — ?status=upcoming|past|cancelled (default upcoming)/scheduling/bookings/{code}/cancel — cancel; auto-refunds paid bookings via StripeGet notified when things happen. Deliveries are POSTed as JSON with an HMAC signature and retried with backoff (up to 5 attempts).
/webhooks{ "url": "https://example.com/hooks/openlagoon", "events": "booking.created,recording.ready" }
// → { "data": { "id": 1, "secret": "shown-once-store-it" } }
/webhooks — list (with delivered/failed counts)/webhooks/{id} — change url/events or is_active/webhooks/{id}booking.created · booking.cancelled · booking.rescheduled · recording.ready — or * for all.
// Header: X-OpenLagoon-Signature: sha256=<hex>
$expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
$valid = hash_equals($expected, $_SERVER['HTTP_X_OPENLAGOON_SIGNATURE'] ?? '');
/domains — { "domain": "book.yourco.com" }Point a CNAME at dash.openlagoon.com (subdomains) or an A record at the platform IP (root domains), then verify.
/domains · POST/domains/{id}/verify · DELETE/domains/{id}/analytics/overview — rooms, participants, bookings, recordings at a glance/analytics/rooms/{id} — per-room participant activity/analytics/usage — plan limits + 6-month rooms/bookings trend/tenants/register — { "name": "...", "email": "..." } → returns your API key (once). Dashboard sign-in is passwordless via magic link./tenants/profile · PUT/tenants/profile| Code | Meaning |
|---|---|
| 400 | Bad request / validation failed (see errors) |
| 401 | Missing or invalid X-API-Key |
| 403 | Plan limit reached or access denied |
| 404 | Resource not found (or not yours) |
| 409 | Conflict (duplicate, already exists) |
| 500 | Server error — contact support |