Public API write surface

Public API v1 is read-only at launch. Current operations:

Dashboard and session-authenticated /api/* routes are not part of the public contract.

Design Before Any Writes

No public write endpoint should ship until the operation has:

explicit API key scopes, separate from dashboard roles;
Professional+ or Enterprise plan gating;
org-scoped Prisma writes with orgId;
idempotency keys for create/update operations;
audit logging for sensitive changes;
rate limits at least as strict as public v1 reads;
OpenAPI documentation and examples;
payload rules that keep PHI and clinical free text out of email/SMS/Stripe metadata.

Potential future writes, pending product decision:

Operation	Default stance	Notes
Create customer	Enterprise candidate	Requires idempotency and duplicate policy.
Create appointment	Enterprise candidate	Must reuse booking availability checks.
Cancel/reschedule booking	Later	Needs customer-facing policy controls.
Webhook/Zapier management	Dashboard-only first	Do not expose until PROD-B17 is decided.

Until this page changes, integrations should use the read-only endpoints and org webhooks.