Choose what to share
Sign in with your personal Sable account and choose the workspace you want to connect. Select the permissions you want to grant. Revenue access is optional. Booking and rescheduling each need their own permission, plus appointment and booking-context access. The connection follows your current Sable role. A connection never grants more access than you have in that workspace. Shared Salon Mode sessions cannot connect apps or approve their proposals. Depending on your choices, the connector can receive:- Appointment dates, times, status, service names, and client and stylist names.
- Client name matches for choosing an existing client, offered services, prices, and availability.
- Revenue totals within your permitted reporting scope.
- A proposed appointment’s price, deposit requirement, policies, and eventual booking result.
Book or reschedule
Ask Muse to find an existing client and a suitable appointment time. If more than one client matches, choose the correct person before continuing. If clients have identical names, choose the client and make the change directly in Sable. Example requests include:- “Find available haircut times with Taylor on Friday.”
- “Propose a haircut for Sarah Jones with Taylor on Friday at 10 a.m.”
- “Propose moving Sarah’s appointment to Saturday at 1 p.m.”
Disconnect
Open Account settings → Connected accounts → Connected apps on Sable’s account site. Choose the connection and confirm Disconnect. This blocks future connector requests and invalidates pending proposals. Removing your workspace membership also ends access. Disconnecting does not cancel appointments already saved or erase data the connected service already received. Sable retains booking and approval history with the workspace. The connected service’s privacy policy governs its copies. See Sable’s Privacy Policy and Terms of Service.API contract
The transport is a raw HTTPS API. Registered clients use OAuth authorization code with S256 PKCE. Client registration is coordinated with Sable; there is no public registration endpoint. Use the exact callback URL registered during onboarding. Confidential clients also authenticate at the token endpoint with HTTP Basic. The enabled deployment serves its contract at/api/v1/connectors/openapi.json.
Use the returned server URL as the resource audience and API base. Authorization
requests require state, resource, and the requested scope. Tokens belong to one
workspace and member. Send tokens only as Authorization: Bearer ….
Access tokens last up to ten minutes. Refresh tokens rotate and last up to thirty days,
within the connection’s expiry. Store the new refresh token before discarding the previous
one. Reusing a consumed code or refresh token with its owning client revokes the connection.
Reconnect when consent expires or is revoked.
List endpoints accept a maximum of fifty records per page, with a default of twenty.
Follow
nextCursor with the same filters. Appointment and revenue date ranges are
inclusive salon-local dates spanning at most thirty-one days. Availability requires both appointment-read and booking-context consent and follows
your appointment visibility. Availability uses local
times and includes their UTC instants; skipped or repeated clock-change times are excluded.
For a booking or reschedule, POST /proposals with a UUID Idempotency-Key. Reuse that
key for retries of the same proposal. A reschedule requires the current appointment’s
updatedAt value as expectedUpdatedAt. Prices, durations, end times, workspace identity,
and conflict overrides cannot be supplied by the agent.
Direct the person to reviewUrl, then check GET /proposals/{id} for the result.
The agent API cannot approve proposals. The creating connection needs its original
read and matching write permissions to read a proposal. A committed receipt contains
the appointment ID and a Sable link. After a lost response, check the existing proposal
before creating another one.
Authenticated requests are limited to 120 per minute per connection and 600 per minute
per workspace. Proposal creation has an additional limit of ten per minute per connection.
Per-IP limits also apply. Responses use
Cache-Control: no-store.