Every endpoint, every field

• Base URL is https://api.hobbstack.com. Every path below is complete — append nothing.
• Authentication is Authorization: Bearer hbs_pk_… on every endpoint except the calendar feed, which takes the key as a token query parameter. Without it you get 401. That query parameter is the same full key, so a feed URL is a live credential for everything the key can read — give calendar feeds their own read:reservations-only key.
• Scope is enforced per endpoint; a valid key without the right scope gets 403 and the code INSUFFICIENT_SCOPE.
• Organization is taken from the key. There is no org parameter, and no key can read another organization’s records.
• Timestamps are ISO 8601 in UTC. Date-only fields are YYYY-MM-DD.
• Nothing here writes. There is no POST, PUT, PATCH or DELETE in the public API. A leaked key is a confidentiality problem, never an integrity one — revoke it in the app.

GET /api/v1/external/reservations

Reservations for the key's organization, newest start time first, with optional filters and a cursor. Soft-deleted reservations are excluded.

Response fields

{
  "items": [
    {
      "id": "6f2f1c9e-6a3b-4a1c-9a6a-2b1f3c4d5e6f",
      "aircraft_id": "b1c2d3e4-f5a6-4718-8293-a1b2c3d4e5f6",
      "pilot_id": "11111111-2222-4333-8444-555555555555",
      "instructor_id": null,
      "activity_type": "solo",
      "start_time": "2026-08-06T14:00:00+00:00",
      "end_time": "2026-08-06T16:00:00+00:00",
      "status": "confirmed",
      "checked_in_at": null,
      "completed_at": null
    }
  ],
  "next_cursor": null
}

Result set

This is the only paginated endpoint. limit defaults to 100 and caps at 500; next_cursor is non-null whenever a full page came back. Pass it back as after, with the same filters, to get the next page. Pages continue in the same order (newest start time first), so walking them returns every reservation once, with no gaps or repeats. A cursor that did not come from this organization's results is refused with 400 and the code INVALID_CURSOR.

GET /api/v1/external/squawks

Reported discrepancies for the organization, newest first. Filter by status, aircraft, or whether the squawk grounds the aircraft.

Response fields

[
  {
    "id": "9c8b7a65-4321-4fed-8cba-0987654321fe",
    "aircraft_id": "b1c2d3e4-f5a6-4718-8293-a1b2c3d4e5f6",
    "description": "Left main tire worn to cord on outboard shoulder",
    "severity": "grounding",
    "status": "open",
    "is_grounding": true,
    "created_at": "2026-08-04T18:22:10+00:00",
    "resolved_at": null
  }
]

Result set

Hard-capped at the 500 most recent squawks with no cursor. An organization with more history will silently see only that window, so filter (status, aircraft_id, is_grounding) rather than expecting the full set.

GET /api/v1/external/maintenance-logs

FAR 43.9 maintenance record entries, most recent event date first. Built for audit exports.

Response fields

[
  {
    "id": "3d3d3d3d-1111-4222-8333-444444444444",
    "aircraft_id": "b1c2d3e4-f5a6-4718-8293-a1b2c3d4e5f6",
    "event_type": "100hr",
    "event_date": "2026-07-28",
    "hobbs_at_event": 4780.0,
    "tach_at_event": 4351.4,
    "ap_cert_number": "3512345",
    "ia_cert_number": null,
    "ia_name": null,
    "ia_sign_off": null,
    "return_to_service": true,
    "performed_by_name": "R. Alvarez",
    "performed_by_cert_number": "3512345",
    "performed_at": "2026-07-28T22:10:00+00:00",
    "last_100hr_hobbs": 4780.0,
    "annual_due_date": "2027-03-31",
    "work_performed": "Performed 100-hour inspection per Cessna 172S maintenance manual..."
  }
]

Result set

Hard-capped at the 500 most recent entries with no cursor. Filter by aircraft_id for a complete per-aircraft history.

GET /api/v1/external/reservations.ics

The same reservations as an iCalendar feed, so a member can subscribe in Apple Calendar, Google Calendar or Outlook. Authenticated with the key in the URL because no calendar client sends an Authorization header on a subscription URL. Returns text/calendar, not JSON.

Response fields

BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Hobbstack//External API//EN
CALSCALE:GREGORIAN
BEGIN:VEVENT
UID:hbs-resv-6f2f1c9e-6a3b-4a1c-9a6a-2b1f3c4d5e6f@hobbstack.com
DTSTART:20260806T140000Z
DTEND:20260806T160000Z
SUMMARY:b1c2d3e4-f5a6-4718-8293-a1b2c3d4e5f6 solo
STATUS:CONFIRMED
END:VEVENT
END:VCALENDAR

Result set

The 500 most recent reservations by start time. Reservations missing a start or end time are skipped.