Ontwikkelaars

Op deze pagina

Add your endpoint under Settings › Integrations › Webhooks. The URL must be https. Choose the events you want, or leave them all unticked to receive every event. Dive Admin shows you a signing secret when the endpoint is created — keep it, you need it to verify requests.

Use Send test to fire a sample form.completed payload at your endpoint before you go live.

Events

Event	Sent when
form.completed	A diver finished a registration or other form
diver.created	A new diver record was created
lead.created	A new enquiry or booking came in
trip.diver_added	A diver was booked onto a trip
invoice.created	An invoice was raised
invoice.paid	An invoice was settled in full
payment.recorded	A payment was recorded against an invoice

Request

Every delivery is a POST with a JSON body:

{
  "event": "form.completed",
  "id": 1234,
  "school_id": 56,
  "created_at": "2026-10-26T09:15:00+00:00",
  "data": { ... event specific ... }
}

Headers

X-DiveAdmin-Event:     form.completed
X-DiveAdmin-Delivery:  1234
X-DiveAdmin-Timestamp: 1793404500
X-DiveAdmin-Signature: sha256=<hmac>

Verifying the signature

The signature is an HMAC-SHA256 over the timestamp, a full stop, and the raw request body, keyed with your signing secret. Compare it against the header before trusting the payload, and reject anything with an old timestamp.

// PHP
$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
hash_equals('sha256=' . $expected, $signatureHeader);

Retries

Answer with any 2xx status as soon as you have the payload; do your work afterwards. Anything else counts as a failure and is retried up to 5 times with an increasing delay (1, 2, 4, 8, 16 minutes). An endpoint that fails 20 times in a row is switched off, and you will see why in Settings › Integrations.

Deliveries are not de-duplicated across retries, so treat id as an idempotency key.

Eindpunt

GET/POST https://diveadmin.com/api/v1/zapier/authenticate

Omschrijving

Verifies your API key and returns your dive school information. This endpoint is used by Zapier to authenticate your connection.

Authenticatie

Requires a Zapier API key (created in Settings > Integrations > Zapier Integration)

Verzoekheaders

api_key: your_zapier_api_key
# OR
X-API-Key: your_zapier_api_key

Antwoord (Geslaagd - 200)

{
  "status": "1",
  "school_name": "Your Dive School Name",
  "school_id": 123
}

Antwoord (Fout - 401)

{
  "status": "0",
  "message": "Invalid API Key"
}

Eindpunt

POST https://diveadmin.com/api/v1/zapier/create-lead

Omschrijving

Creates a new lead in Dive Admin. If a diver with the same email exists, the lead will be associated with that diver. Otherwise, a new diver will be created.

Authenticatie

Requires a Zapier API key (created in Settings > Integrations > Zapier Integration)

Verzoekheaders

Content-Type: application/json
api_key: your_zapier_api_key
# OR
X-API-Key: your_zapier_api_key

Parameters verzoekinhoud

Parameter	Type	Vereist	Omschrijving
first_name	string	Yes	First name of the lead/diver (max 255 characters)
surname	string	No	Last name of the lead/diver
email	string (email)	No	Email address (used to find existing divers)
phone or mobile	string	No	Phone number (either field name works)
status	string	No	Lead status: enquiry, sale, process, or lost (default: enquiry)
value	numeric	No	Lead value/amount (default: 0)
message	string	No	Lead message/notes (default: "No Message.")
arrival_date	date string	No	Arrival date (format: YYYY-MM-DD or any date format Laravel can parse)
departure_date	date string	No	Departure date (format: YYYY-MM-DD or any date format Laravel can parse)
group_size	integer	No	Number of people in the group

Voorbeeldverzoek

POST /api/v1/zapier/create-lead
Content-Type: application/json
api_key: your_zapier_api_key

{
  "first_name": "John",
  "surname": "Doe",
  "email": "[email protected]",
  "phone": "+1234567890",
  "status": "enquiry",
  "value": 500,
  "message": "Interested in PADI Open Water course",
  "arrival_date": "2024-06-15",
  "departure_date": "2024-06-20",
  "group_size": 2
}

Antwoord (Geslaagd - 201)

{
  "status": "1",
  "message": "Lead Created",
  "lead_id": 123,
  "diver_id": 456
}

Antwoord (Fout - 401)

{
  "status": "0",
  "message": "Invalid API Key"
}

Opmerkingen

• Leads are automatically tagged with source_channel: 'zapier'
• Lead notification emails are automatically sent when a lead is created
• The system automatically creates or finds existing divers based on email, first name, and surname

Eindpunt

POST https://diveadmin.com/api/v1/wordpress/newlead

Omschrijving

Creates a new lead from a WordPress website. If a diver with the same email exists, the lead will be associated with that diver. Otherwise, a new diver will be created.

Authenticatie

Requires a WordPress API key (created in Settings > Integrations > Wordpress Website)

Verzoekheaders

Content-Type: application/json
api_key: your_wordpress_api_key
# OR
X-API-Key: your_wordpress_api_key

Parameters verzoekinhoud

Parameter	Type	Vereist	Omschrijving
first_name	string	No	First name of the lead/diver (default: "?")
surname	string	No	Last name of the lead/diver (default: "?")
email	string (email)	No	Email address (used to find existing divers)
phone	string	No	Phone number
status	string	No	Lead status (default: enquiry)
value	numeric	No	Lead value/amount (default: 0)
message	string	No	Lead message/notes (default: "No Message.")
arrival_date	date string	No	Arrival date

Voorbeeldverzoek

POST /api/v1/wordpress/newlead
Content-Type: application/json
api_key: your_wordpress_api_key

{
  "first_name": "Jane",
  "surname": "Smith",
  "email": "[email protected]",
  "phone": "+1234567890",
  "status": "enquiry",
  "value": 300,
  "message": "Interested in diving trip",
  "arrival_date": "2024-07-01"
}

Antwoord (Geslaagd - 200)

{
  "status": "1",
  "message": "Lead Created"
}

Antwoord (Fout - 200 met foutstatus)

{
  "status": "0",
  "message": "Invalid API Key"
}

Opmerkingen

• Leads are automatically tagged with source_channel: 'wordpress'
• Lead notification emails are automatically sent when a lead is created
• The message field will automatically append " - Created via WordPress Plugin"

MCP-eindpunt

POST https://diveadmin.com/api/v1/mcp

JSON-RPC 2.0 over HTTP. Supported methods: initialize, tools/list, tools/call, ping.

Ontdekkingsmetadata

• GET https://diveadmin.com/.well-known/oauth-protected-resource — points MCP clients at the authorization server (RFC 9728).
• GET https://diveadmin.com/.well-known/oauth-authorization-server — OAuth server metadata (RFC 8414).

Authenticatie

Two options:

1. Static token — created in Settings › Integrations › MCP Server. Simplest for self-hosted setups (Claude Desktop / Claude Code config). Tokens look like mcp_….
2. OAuth access token — for app-store-listed MCP clients. The token must have the mcp scope.

Send the token as: Authorization: Bearer <token>

Instellen in Claude Desktop

Open Claude Desktop › Settings › Developer › Edit Config and add:

{
  "mcpServers": {
    "diveadmin": {
      "transport": "http",
      "url": "https://diveadmin.com/api/v1/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN_HERE" }
    }
  }
}

Clients that support OAuth discovery can skip the token-paste step: point them at the MCP URL and they will follow the WWW-Authenticate header to the authorization server, prompt the user to sign in, and receive an access token automatically.

Beveiligingsmodel

• Tokens hashed (SHA-256) at rest — plaintext shown once and never stored.
• IP-based brute-force lockout (10 failures → 15-minute cool-down).
• Per-token rate limit (120 requests/minute).
• Revoking a token or disabling the integration takes effect immediately.
• OAuth diveadmin.<permission> scopes (e.g. diveadmin.leads) narrow which tools a token can reach.

Metadata (RFC 8414)	GET https://diveadmin.com/.well-known/oauth-authorization-server
Authorize	GET https://diveadmin.com/oauth/authorize
Token	POST https://diveadmin.com/api/oauth/token
User info	GET https://diveadmin.com/api/oauth/userinfo
Revoke (RFC 7009)	POST https://diveadmin.com/api/oauth/revoke
Dynamic registration (RFC 7591)	POST https://diveadmin.com/api/oauth/register

Ondersteunde flow

Authorization code + PKCE (S256). Public clients must send code_challenge; confidential clients authenticate at the token endpoint via HTTP Basic or client_secret_post.

Scopes

Scope	Doel
openid	Sign the user in
profile	Return name at /userinfo
email	Return email + verified flag at /userinfo
mcp	Use the MCP server with this token
offline_access	Issue a refresh token
diveadmin.<perm>	Narrow MCP/API access to a specific DiveStaff permission (e.g. diveadmin.leads, diveadmin.divers, diveadmin.finance_invoices)

Een app registreren

First-party apps (including "Login with DiveAdmin" on your own diving website): contact DiveAdmin support to register your app. We enter the redirect URI(s), pick scopes, and issue a client_id (and client_secret if confidential).

Third-party apps (e.g. a commercial MCP client listed in a directory): POST to the dynamic registration endpoint with your name, redirect URIs and grant types. Tokens require an end-user consent screen at first use.

Voorbeeld: Inloggen met DiveAdmin

1. Redirect the user to:
   https://diveadmin.com/oauth/authorize?response_type=code
     &client_id=YOUR_CLIENT_ID
     &redirect_uri=https://yoursite.com/auth/diveadmin/callback
     &scope=openid+profile+email
     &state=RANDOM_NONCE
     &code_challenge=BASE64URL(SHA256(verifier))
     &code_challenge_method=S256

2. On callback, exchange the code for tokens:
   POST https://diveadmin.com/api/oauth/token
     grant_type=authorization_code
     code=...
     redirect_uri=https://yoursite.com/auth/diveadmin/callback
     client_id=YOUR_CLIENT_ID
     code_verifier=... (PKCE verifier)

3. Fetch the user's profile:
   GET https://diveadmin.com/api/oauth/userinfo
     Authorization: Bearer <access_token>
   => { "sub": "123", "name": "...", "email": "...", "email_verified": true }

Beveiligingsmodel

• Client secrets, authorization codes and tokens are all SHA-256 hashed at rest.
• Redirect URIs are exact-match — no wildcards, no subpaths.
• Authorization codes are single-use and expire after 10 minutes.
• Refresh tokens rotate on use (the old one stops working).
• Access tokens are revocable; disabling a client or revoking a user's consent invalidates tokens immediately.
• Scopes can never exceed the owning user's live DiveStaff permissions.

We publish individual REST endpoints for each supported integration (Zapier, WordPress, Wix, Shopify — documented above and in the integration-specific setup guides). A general-purpose REST API key is also available under Settings › Integrations › REST API, but the surface of that API is currently bespoke per integration.

If you need a custom REST integration with a specific endpoint shape, please contact us — we prioritise the endpoints our customers actually need rather than shipping a large speculative surface.

For AI-driven read/write access, we recommend MCP — it already exposes the full Coral tool set, with permission scoping and discovery baked in.