Developers

On this page

Endpoint

GET/POST https://diveadmin.com/api/v1/zapier/authenticate

Description

Verifies your API key and returns your dive school information. This endpoint is used by Zapier to authenticate your connection.

Authentication

Requires a Zapier API key (created in Settings > Integrations > Zapier Integration)

Request Headers

api_key: your_zapier_api_key
# OR
X-API-Key: your_zapier_api_key

Response (Success - 200)

{
  "status": "1",
  "school_name": "Your Dive School Name",
  "school_id": 123
}

Response (Error - 401)

{
  "status": "0",
  "message": "Invalid API Key"
}

Endpoint

POST https://diveadmin.com/api/v1/zapier/create-lead

Description

Creates a new lead in Dive Admin. If a diver with the same email exists, the lead will be associated with that diver. Otherwise, a new diver will be created.

Authentication

Requires a Zapier API key (created in Settings > Integrations > Zapier Integration)

Request Headers

Content-Type: application/json
api_key: your_zapier_api_key
# OR
X-API-Key: your_zapier_api_key

Request Body Parameters

Parameter	Type	Required	Description
first_name	string	Yes	First name of the lead/diver (max 255 characters)
surname	string	No	Last name of the lead/diver
email	string (email)	No	Email address (used to find existing divers)
phone or mobile	string	No	Phone number (either field name works)
status	string	No	Lead status: enquiry, sale, process, or lost (default: enquiry)
value	numeric	No	Lead value/amount (default: 0)
message	string	No	Lead message/notes (default: "No Message.")
arrival_date	date string	No	Arrival date (format: YYYY-MM-DD or any date format Laravel can parse)
departure_date	date string	No	Departure date (format: YYYY-MM-DD or any date format Laravel can parse)
group_size	integer	No	Number of people in the group

Example Request

POST /api/v1/zapier/create-lead
Content-Type: application/json
api_key: your_zapier_api_key

{
  "first_name": "John",
  "surname": "Doe",
  "email": "[email protected]",
  "phone": "+1234567890",
  "status": "enquiry",
  "value": 500,
  "message": "Interested in PADI Open Water course",
  "arrival_date": "2024-06-15",
  "departure_date": "2024-06-20",
  "group_size": 2
}

Response (Success - 201)

{
  "status": "1",
  "message": "Lead Created",
  "lead_id": 123,
  "diver_id": 456
}

Response (Error - 401)

{
  "status": "0",
  "message": "Invalid API Key"
}

Notes

• Leads are automatically tagged with source_channel: 'zapier'
• Lead notification emails are automatically sent when a lead is created
• The system automatically creates or finds existing divers based on email, first name, and surname

Endpoint

POST https://diveadmin.com/api/v1/wordpress/newlead

Description

Creates a new lead from a WordPress website. If a diver with the same email exists, the lead will be associated with that diver. Otherwise, a new diver will be created.

Authentication

Requires a WordPress API key (created in Settings > Integrations > Wordpress Website)

Request Headers

Content-Type: application/json
api_key: your_wordpress_api_key
# OR
X-API-Key: your_wordpress_api_key

Request Body Parameters

Parameter	Type	Required	Description
first_name	string	No	First name of the lead/diver (default: "?")
surname	string	No	Last name of the lead/diver (default: "?")
email	string (email)	No	Email address (used to find existing divers)
phone	string	No	Phone number
status	string	No	Lead status (default: enquiry)
value	numeric	No	Lead value/amount (default: 0)
message	string	No	Lead message/notes (default: "No Message.")
arrival_date	date string	No	Arrival date

Example Request

POST /api/v1/wordpress/newlead
Content-Type: application/json
api_key: your_wordpress_api_key

{
  "first_name": "Jane",
  "surname": "Smith",
  "email": "[email protected]",
  "phone": "+1234567890",
  "status": "enquiry",
  "value": 300,
  "message": "Interested in diving trip",
  "arrival_date": "2024-07-01"
}

Response (Success - 200)

{
  "status": "1",
  "message": "Lead Created"
}

Response (Error - 200 with error status)

{
  "status": "0",
  "message": "Invalid API Key"
}

Notes

• Leads are automatically tagged with source_channel: 'wordpress'
• Lead notification emails are automatically sent when a lead is created
• The message field will automatically append " - Created via WordPress Plugin"

MCP endpoint

POST https://diveadmin.com/api/v1/mcp

JSON-RPC 2.0 over HTTP. Supported methods: initialize, tools/list, tools/call, ping.

Discovery metadata

• GET https://diveadmin.com/.well-known/oauth-protected-resource — points MCP clients at the authorization server (RFC 9728).
• GET https://diveadmin.com/.well-known/oauth-authorization-server — OAuth server metadata (RFC 8414).

Authentication

Two options:

1. Static token — created in Settings › Integrations › MCP Server. Simplest for self-hosted setups (Claude Desktop / Claude Code config). Tokens look like mcp_….
2. OAuth access token — for app-store-listed MCP clients. The token must have the mcp scope.

Send the token as: Authorization: Bearer <token>

Set up in Claude Desktop

Open Claude Desktop › Settings › Developer › Edit Config and add:

{
  "mcpServers": {
    "diveadmin": {
      "transport": "http",
      "url": "https://diveadmin.com/api/v1/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN_HERE" }
    }
  }
}

Clients that support OAuth discovery can skip the token-paste step: point them at the MCP URL and they will follow the WWW-Authenticate header to the authorization server, prompt the user to sign in, and receive an access token automatically.

Security model

• Tokens hashed (SHA-256) at rest — plaintext shown once and never stored.
• IP-based brute-force lockout (10 failures → 15-minute cool-down).
• Per-token rate limit (120 requests/minute).
• Revoking a token or disabling the integration takes effect immediately.
• OAuth diveadmin.<permission> scopes (e.g. diveadmin.leads) narrow which tools a token can reach.

Metadata (RFC 8414)	GET https://diveadmin.com/.well-known/oauth-authorization-server
Authorize	GET https://diveadmin.com/oauth/authorize
Token	POST https://diveadmin.com/api/oauth/token
User info	GET https://diveadmin.com/api/oauth/userinfo
Revoke (RFC 7009)	POST https://diveadmin.com/api/oauth/revoke
Dynamic registration (RFC 7591)	POST https://diveadmin.com/api/oauth/register

Supported flow

Authorization code + PKCE (S256). Public clients must send code_challenge; confidential clients authenticate at the token endpoint via HTTP Basic or client_secret_post.

Scopes

Scope	Purpose
openid	Sign the user in
profile	Return name at /userinfo
email	Return email + verified flag at /userinfo
mcp	Use the MCP server with this token
offline_access	Issue a refresh token
diveadmin.<perm>	Narrow MCP/API access to a specific DiveStaff permission (e.g. diveadmin.leads, diveadmin.divers, diveadmin.finance_invoices)

Registering an app

First-party apps (including "Login with DiveAdmin" on your own diving website): contact DiveAdmin support to register your app. We enter the redirect URI(s), pick scopes, and issue a client_id (and client_secret if confidential).

Third-party apps (e.g. a commercial MCP client listed in a directory): POST to the dynamic registration endpoint with your name, redirect URIs and grant types. Tokens require an end-user consent screen at first use.

Example: Login with DiveAdmin

1. Redirect the user to:
   https://diveadmin.com/oauth/authorize?response_type=code
     &client_id=YOUR_CLIENT_ID
     &redirect_uri=https://yoursite.com/auth/diveadmin/callback
     &scope=openid+profile+email
     &state=RANDOM_NONCE
     &code_challenge=BASE64URL(SHA256(verifier))
     &code_challenge_method=S256

2. On callback, exchange the code for tokens:
   POST https://diveadmin.com/api/oauth/token
     grant_type=authorization_code
     code=...
     redirect_uri=https://yoursite.com/auth/diveadmin/callback
     client_id=YOUR_CLIENT_ID
     code_verifier=... (PKCE verifier)

3. Fetch the user's profile:
   GET https://diveadmin.com/api/oauth/userinfo
     Authorization: Bearer <access_token>
   => { "sub": "123", "name": "...", "email": "...", "email_verified": true }

Security model

• Client secrets, authorization codes and tokens are all SHA-256 hashed at rest.
• Redirect URIs are exact-match — no wildcards, no subpaths.
• Authorization codes are single-use and expire after 10 minutes.
• Refresh tokens rotate on use (the old one stops working).
• Access tokens are revocable; disabling a client or revoking a user's consent invalidates tokens immediately.
• Scopes can never exceed the owning user's live DiveStaff permissions.

We publish individual REST endpoints for each supported integration (Zapier, WordPress, Wix, Shopify — documented above and in the integration-specific setup guides). A general-purpose REST API key is also available under Settings › Integrations › REST API, but the surface of that API is currently bespoke per integration.

If you need a custom REST integration with a specific endpoint shape, please contact us — we prioritise the endpoints our customers actually need rather than shipping a large speculative surface.

For AI-driven read/write access, we recommend MCP — it already exposes the full Coral tool set, with permission scoping and discovery baked in.