> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cicini.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Public API write surface

> Current decision and future guardrails for Cicini Public API writes

# Public API write surface

Public API v1 is **read-only** at launch.

Current operations:

* `GET /api/public/v1/customers`
* `GET /api/public/v1/appointments`

Dashboard and session-authenticated `/api/*` routes are not part of the public contract.

## Design Before Any Writes

No public write endpoint should ship until the operation has:

* explicit API key scopes, separate from dashboard roles;
* Professional+ or Enterprise plan gating;
* org-scoped Prisma writes with `orgId`;
* idempotency keys for create/update operations;
* audit logging for sensitive changes;
* rate limits at least as strict as public v1 reads;
* OpenAPI documentation and examples;
* payload rules that keep PHI and clinical free text out of email/SMS/Stripe metadata.

## Candidate Writes

Potential future writes, pending product decision:

| Operation                 | Default stance       | Notes                                      |
| ------------------------- | -------------------- | ------------------------------------------ |
| Create customer           | Enterprise candidate | Requires idempotency and duplicate policy. |
| Create appointment        | Enterprise candidate | Must reuse booking availability checks.    |
| Cancel/reschedule booking | Later                | Needs customer-facing policy controls.     |
| Webhook/Zapier management | Dashboard-only first | Do not expose until PROD-B17 is decided.   |

Until this page changes, integrations should use the read-only endpoints and org webhooks.