The DiveDesk API

DiveDesk has a read-only REST API, version 1, documented at divedesk.io/docs/api. It is for your web developer or a reporting tool: pull your contacts, orders and scheduled classes into something else. There is no write access yet.

Get a key

1. Keys are issued by DiveDesk, not from your admin. Email hello@divedesk.io and ask for an API key for your shop.
2. The full key — it starts dd_live_ — is shown once. Store it where the code that uses it lives. Only a hash is kept on the server, so a lost key is revoked and re-issued, never recovered.
3. Send it on every request as a bearer token: Authorization: Bearer dd_live_…. The key alone identifies the shop; there is no shop id in the URL, and a key can only read its own shop.

What you can read

• GET /api/v1/ping — connectivity and auth check; returns the shop the key belongs to.
• GET /api/v1/shop — your profile: slug, name, status, plan, timezone, domain.
• GET /api/v1/students — contacts, newest first, with page, limit (max 100) and search on email, name or phone. Contact fields only — never medical or waiver data.
• GET /api/v1/orders — orders with line items, newest first; filter with status (for example paid).
• GET /api/v1/classes — scheduled classes with their days; upcoming=true keeps only classes with a future day and drops cancelled ones.

Requests are limited to 120 per minute per key; over that you get a 429. Errors are JSON with one error string: 401 for a missing, malformed or revoked key, 403 while the shop is suspended or churned.

Writes (creating orders, enrolling students) and outbound webhooks are on the roadmap. Stripe and Quo webhooks into DiveDesk are separate, signature-verified endpoints and do not use API keys.