API Reference

curl -G https://nabaha.ai/api/v1/appointments/availability \
  -H "Authorization: Bearer nb_live_your_key" \
  --data-urlencode "service_id=SERVICE_ID" \
  --data-urlencode "branch_id=BRANCH_ID" \
  --data-urlencode "date=2026-07-01" \
  --data-urlencode "time=10:00"

Authorization: Bearer nb_live_your_key

curl -G https://nabaha.ai/api/v1/appointments/availability \
  -H "Authorization: Bearer nb_live_your_key" \
  --data-urlencode "service_id=SERVICE_ID" \
  --data-urlencode "branch_id=BRANCH_ID" \
  --data-urlencode "date=2026-07-01" \
  --data-urlencode "time=10:00"

{
  "available": true,
  "slot": { "date": "2026-07-01", "time": "10:00", "status": "available" }
}

curl -G https://nabaha.ai/api/v1/appointments/resources \
  -H "Authorization: Bearer nb_live_your_key" \
  --data-urlencode "service_id=SERVICE_ID" \
  --data-urlencode "branch_id=BRANCH_ID"

[
  { "resource_id": "8f1...", "name": "Dr. Ahmed", "name_ar": "د. أحمد" },
  { "resource_id": "b27...", "name": "Dr. Sara",  "name_ar": "د. سارة" }
]

curl -G https://nabaha.ai/api/v1/appointments/resources/RESOURCE_ID/slots \
  -H "Authorization: Bearer nb_live_your_key" \
  --data-urlencode "service_id=SERVICE_ID" \
  --data-urlencode "branch_id=BRANCH_ID" \
  --data-urlencode "date_from=2026-07-01" \
  --data-urlencode "date_to=2026-07-03"

{
  "resource_id": "8f1...",
  "name_ar": "د. أحمد",
  "service_id": "SERVICE_ID",
  "slots_by_date": [
    { "date": "2026-07-01", "available_times": ["09:00", "09:30", "10:00"] },
    { "date": "2026-07-02", "available_times": ["14:00", "14:30"] }
  ]
}

curl -X POST https://nabaha.ai/api/v1/appointments \
  -H "Authorization: Bearer nb_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "service_id": "SERVICE_ID",
    "branch_id": "BRANCH_ID",
    "customer_name": "Mohammed Al-Otaibi",
    "date": "2026-07-01",
    "time": "10:00",
    "phone": "+9665XXXXXXXX"
  }'

HTTP/1.1 201 Created

{ "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479" }

POST  https://your-system.com/nabaha-webhook
X-Nabaha-Signature: sha256=...

{
  "event": "appointment.created",
  "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "service_id": "SERVICE_ID",
  "branch_id": "BRANCH_ID",
  "date": "2026-07-01",
  "time": "10:00"
}

GET /availability?resource_ids=doc-1,doc-2&from=2026-06-25T00:00:00%2B03:00&to=2026-07-09T00:00:00%2B03:00
Authorization: Bearer <your token>

{
  "resources": [
    {
      "resource_id": "staff-42",
      "busy": [
        { "start": "2026-07-01T09:00:00+03:00", "end": "2026-07-01T10:00:00+03:00" }
      ]
    }
  ]
}

{
  "resource_id": "staff-42",
  "start": "2026-07-01T10:00:00+03:00",
  "end": "2026-07-01T10:30:00+03:00",
  "service": "consultation",
  "customer": {
    "name": "Mohammed Al-Otaibi",
    "phone": "+966501234567"
  },
  "nabaha_appointment_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479"
}

DELETE /booking/erp-9001
Authorization: Bearer <your-token>

HTTP/1.1 204 No Content

{
  "resources": [
    { "id": "dr-7", "name": "Dr. Abdulmajeed" },
    { "id": "dr-3", "name": "Dr. Sarah" }
  ]
}

// nabaha-connector.js — reference server (Node / Express)
// Implements the two endpoints Nabaha calls. Run it, host it on public HTTPS,
// then paste its URL into Nabaha → Integrations → Connect your system.
import express from "express";
const app = express();
app.use(express.json());

const TOKEN = process.env.NABAHA_TOKEN; // the token you set in the Nabaha dashboard

const auth = (req, res, next) =>
  req.get("authorization") === `Bearer ${TOKEN}` ? next() : res.sendStatus(401);

// 1) Nabaha pulls your resources' busy times every few minutes.
app.get("/availability", auth, (req, res) => {
  const ids = String(req.query.resource_ids || "").split(",").filter(Boolean);
  // TODO: look up busy times in YOUR system for these ids + the from/to window.
  res.json({
    resources: ids.map((id) => ({
      resource_id: id,
      busy: [{ start: "2026-06-25T14:00:00+03:00", end: "2026-06-25T15:00:00+03:00" }],
    })),
  });
});

// 2) Nabaha pushes a booking. POST /booking is CREATE-OR-UPDATE, keyed on
//    nabaha_appointment_id: a repeat with new start/end is a reschedule.
const bookings = {}; // keyed by nabaha_appointment_id
app.post("/booking", auth, (req, res) => {
  const { nabaha_appointment_id, start, end } = req.body;
  if (bookings[nabaha_appointment_id]) {
    // Known id → reschedule: update this booking's start/end in YOUR system.
    return res.json({ external_id: bookings[nabaha_appointment_id] });
  }
  // TODO: create the booking in YOUR system, return its id.
  const externalId = "appt-" + Date.now();
  bookings[nabaha_appointment_id] = externalId;
  res.json({ external_id: externalId });
});

// 3) Cancel (optional).
app.delete("/booking/:id", auth, (req, res) => {
  // TODO: cancel req.params.id in YOUR system.
  res.sendStatus(204);
});

// 4) OPTIONAL — implement to enable auto-mapping in Nabaha.
//    Nabaha calls this once on connect to discover and pre-map your resources.
app.get("/resources", auth, (req, res) =>
  res.json({ resources: [{ id: "dr-7", name: "Dr. Abdulmajeed" }] })
);

app.listen(3000, () => console.log("Nabaha connector on :3000"));

# Odoo reference adapter — maps the Nabaha contract to Odoo's external API (XML-RPC).
# Odoo has no native Nabaha-shaped endpoints; booked time lives in calendar.event.
# Host this as your service; set the 5 env vars below.
import os, xmlrpc.client
from datetime import datetime, timezone
from fastapi import FastAPI, Header, HTTPException, Query
from fastapi.responses import Response

ODOO_URL, ODOO_DB = os.environ["ODOO_URL"], os.environ["ODOO_DB"]
ODOO_USER, ODOO_KEY = os.environ["ODOO_USER"], os.environ["ODOO_API_KEY"]  # API key = password (Odoo 14+)
NABAHA_TOKEN = os.environ["AUTH_TOKEN"]                                     # the nbh_ token from the wizard

common = xmlrpc.client.ServerProxy(f"{ODOO_URL}/xmlrpc/2/common")
uid = common.authenticate(ODOO_DB, ODOO_USER, ODOO_KEY, {})
obj = xmlrpc.client.ServerProxy(f"{ODOO_URL}/xmlrpc/2/object")
def kw(model, method, *a, **k): return obj.execute_kw(ODOO_DB, uid, ODOO_KEY, model, method, list(a), k)

app = FastAPI()
def auth(a):
    if a != f"Bearer {NABAHA_TOKEN}": raise HTTPException(401)
def to_iso(s):  return datetime.strptime(s, "%Y-%m-%d %H:%M:%S").replace(tzinfo=timezone.utc).isoformat()
def to_odoo(s): return datetime.fromisoformat(s).astimezone(timezone.utc).strftime("%Y-%m-%d %H:%M:%S")

@app.get("/resources")
def resources(authorization: str = Header(None)):
    auth(authorization)
    users = kw("res.users", "search_read", [["share","=",False]], fields=["id","name"])
    return {"resources": [{"id": str(u["id"]), "name": u["name"]} for u in users]}

@app.get("/availability")
def availability(resource_ids: str, to: str = "", from_: str = Query("", alias="from"),
                 authorization: str = Header(None)):
    auth(authorization)
    res = []
    for rid in filter(None, resource_ids.split(",")):
        evs = kw("calendar.event", "search_read",
                 [["user_id","=",int(rid)], ["start","<",to_odoo(to)], ["stop",">",to_odoo(from_)]],
                 fields=["start","stop"])
        res.append({"resource_id": rid,
                    "busy": [{"start": to_iso(e["start"]), "end": to_iso(e["stop"])} for e in evs]})
    return {"resources": res}

@app.post("/booking")
def booking(p: dict, authorization: str = Header(None)):
    auth(authorization)
    nid = p["nabaha_appointment_id"]
    dup = kw("calendar.event", "search", [["x_nabaha_id","=",nid]], limit=1)  # idempotency + reschedule
    phone = p.get("customer", {}).get("phone", "")
    pids = kw("res.partner", "search", [["phone","=",phone]], limit=1) if phone else []
    pid = pids[0] if pids else kw("res.partner", "create",
                                  {"name": p.get("customer",{}).get("name","Customer"), "phone": phone})
    vals = {"name": p.get("service") or "Nabaha booking", "start": to_odoo(p["start"]),
            "stop": to_odoo(p["end"]), "user_id": int(p["resource_id"]),
            "partner_ids": [(6,0,[pid])], "x_nabaha_id": nid}
    if dup: kw("calendar.event","write",[dup[0]],vals); eid = dup[0]
    else:   eid = kw("calendar.event","create",vals)
    return {"external_id": str(eid)}

@app.delete("/booking/{external_id}")
def cancel(external_id: str, authorization: str = Header(None)):
    auth(authorization)
    kw("calendar.event", "write", [int(external_id)], {"active": False})
    return Response(status_code=204)

https://dev.nabaha.ai/api/v1/demo/mock-erp