Bookings, end to end

The four bookings surfaces

Bookings touches four distinct URLs. Three of them live behind the company login; the fourth is the public-facing page your customers see.

Operator panel — /bookings

The home of the module for managers. Default view is a 14-day calendar with pending / confirmed / revenue stats, plus sub-pages for calendar, customers, services, professionals and settings. Clicking any booking opens its detail screen — edit, reschedule, cancel or refund without leaving the page.

Public booking page — /book/{slug}

The customer-facing landing page. Lists every public service, lets the visitor pick a service, professional, date and slot, and books in one form. No GetUp account required for the customer; only the slug needs to be known.

Per-professional share link — /book/{slug}/p/{professionalId}

The same public page, scoped to one professional. Drop the link in an email signature, an Instagram bio or a partner site so a specific calendar gets the bookings. Customers don't see other professionals on this URL.

Cancel link — /book/cancel/{token}

Signed token sent in the customer's confirmation email. One click cancels — no login, no chat-with-us. Token is single-use and time-bounded; clicking it twice rejects the second visit.

Setup — five steps from a fresh workspace

Wix is optional — skip step 4 if you don't have a Wix site.

1. 01Open Bookings → Settings (/bookings/settings). Toggle Public booking on, pick the slug your customers will use, set the brand colour and confirmation email signature, and choose whether new bookings are auto-confirmed or require manager approval.
2. 02Add the services you sell under Bookings → Services. Each service has a duration, price, optional buffer time, and a list of professionals who can perform it. Mark the service as Public to make it appear on /book/{slug}.
3. 03Add or invite professionals under Bookings → Professionals. Each professional has working hours per day-of-week, time-off blocks, and (optional) Google Calendar sync from /integrations.
4. 04Connect Wix Bookings (optional) from /integrations: click Connect on the Wix card, accept the OAuth scopes, and the first sync runs automatically. Existing Wix services and bookings are imported; future cancellations sync both ways.
5. 05Share the public URL or per-professional URL with customers. Bookings drop into the operator panel and trigger a confirmation + .ics email; if you set requireApproval, they wait in Pending until a manager confirms.

Anatomy of a service

A service captures everything a customer needs to know before booking and everything the system needs to enforce constraints:

• Name and short description — shown on the public page card.
• Duration in minutes. Slot grids are computed from this; choose multiples of your shortest service for clean grids.
• Price, in your workspace currency. Optional — leave blank to take payment offline.
• Buffer time — minutes of breathing room before and after each booking. Useful for clean-up, changeover or travel between physical chairs.
• Eligible professionals — only the professionals you tick can be booked for this service.
• Public flag — if off, the service is orderable from the operator panel only (e.g. internal maintenance or off-menu services).
• Active flag — soft-archives a service without losing history. Past bookings still show, no new bookings can be made.

Anatomy of a professional

A professional is the person whose calendar fills up:

• Identity — name, role label, photo (optional). The photo appears on the public page selector.
• Working hours per weekday. Bookings can only land inside these windows.
• Time-off blocks — sick days, vacations, external commitments. Public slots inside time-off return as unavailable.
• Calendar sync (optional, Pro) — Google Calendar OAuth from /integrations. New bookings push to the professional's calendar; external events on that calendar block the corresponding slots in GetUp.
• Wix mapping (optional) — when Wix Bookings is connected, professionals are mirrored from Wix. You can also add native-only professionals that don't have a Wix counterpart.

How the public page works

GET /book/{slug} serves the public page if and only if the company has the booking module enabled and bookingSettings.isPubliclyBookable is true. If either is false, the page returns 404 — not 401. We don't leak existence to the open internet.

The page progresses through three steps:

1. Pick a service — list of public, active services with duration, price and a short description.
2. Pick a professional and slot — slots are fetched from GET /api/public/book/{slug}/slots and respect working hours, time-off, existing bookings and calendar-sync events.
3. Confirm details — the customer enters name, email, phone (optional), and a hidden honeypot website field. On submit, POST /api/public/book/{slug}/booking upserts the customer, creates the booking inside a Firestore transaction (so two simultaneous bookings can't take the same slot), and sends emails.

Rate limiting and spam protection

• 20 bookings / hour / IP on the public endpoint. Above the threshold the API returns 429 with a Retry-After header.
• Honeypot field — a hidden website input on the form. Real customers leave it blank; bots fill it. Filled submissions return 200 OK and are silently dropped — we don't tell the bot it failed.
• Email validation — the platform validates the email address syntactically and accepts the booking regardless of MX records. Bounced confirmations show as warnings on the operator panel.

Operating a venue that legitimately exceeds 20 sign-ups per hour from one network? Talk to us about Enterprise — we can allowlist your network.

Confirmations and cancellations

On every successful booking, two emails go out:

• To the customer — confirmation with service, professional, date, time, address (location), an .ics file for their calendar, and a signed cancel link valid until the booking time.
• To the assigned professional and the company owner — notification with the same details so the calendar update is visible internally.

Cancellations propagate the same way regardless of which side initiated them — operator panel, customer cancel link, or Wix sync. The customer and the professional get an updated .ics that supersedes the original event.

Wix Bookings sync

For operators already running Wix sites with Wix Bookings, the sync is two-way:

• OAuth handshake — start at /integrations, click Connect on the Wix card. You're redirected to Wix, accept the scopes, return to /integrations?wix_connected=1.
• First sync — services and professionals are imported from Wix on first connection. Existing Wix bookings flow into the GetUp calendar.
• Steady state — webhooks both ways: a booking on Wix immediately appears in GetUp; a cancel on Wix immediately cancels in GetUp; the reverse is also true.
• Disconnect — from the same /integrations card. Existing bookings stay in GetUp; the link is severed.

Where to go next

• Bookings — module overview — the operator-side surfaces
• Wix Bookings integration — OAuth flow and scope details
• Google Calendar integration — per-professional sync
• How-to: publish a booking page and share a per-professional link