Skip to main content

​
Connect Calendly

Calendly uses OAuth with PKCE. Automate.ax requests users:read when you connect, then requests the scopes required by the actions and triggers in your deployment. Access tokens expire after two hours. Calendly rotates refresh tokens after every use; Automate.ax stores the replacement atomically. Actions declare one of these scopes: users:read, organizations:read, event_types:read, event_types:write, availability:read, availability:write, locations:read, scheduled_events:read, scheduled_events:write, routing_forms:read, or scheduling_links:write. Triggers also require webhooks:write and the read scope for their event family. A write scope includes its corresponding read access. Calendly still applies the connected user’s role and plan. Direct invitee booking requires Standard or above. Routing forms and their submissions require Teams or above. Organization-scoped resources and webhooks can require an organization owner or admin.

​
Resource identifiers

Calendly returns canonical resource URLs such as https://api.calendly.com/users/AAAAAAAAAAAAAAAA. Pass the complete URL to fields named user, organization, eventType, form, or invitee. Pass only AAAAAAAAAAAAAAAA to fields ending in Id. List actions return { items, pageInfo }. Pass pageInfo.nextPageToken as pageToken to fetch the next page. count defaults to 20 and accepts 1–100.

​
Rate limits

Calendly permits 500 requests per user per minute on paid plans and 50 on free plans. Direct invitee creation has lower plan-specific limits. Automate.ax retries 429 responses after Calendly’s X-RateLimit-Reset delay. Other client errors fail the action without retry, while server failures remain eligible for retry.

​
Signed lifecycle webhooks

Every trigger needs organizationUri and a provider scope:
  • organization watches the organization and needs no additional URI.
  • user also needs userUri.
  • group also needs groupUri.
Routing form submissions and the broad scheduling-event trigger support only organization scope. Semantic event type, invitee, and no-show triggers can use organization, user, or group scope. Automate.ax combines compatible triggers into one Calendly webhook, reconciles its exact callback URL and event set, and deletes it after the final subscription or account connection is removed. It verifies Calendly-Webhook-Signature as HMAC-SHA256 over the exact timestamp and body, rejects deliveries more than three minutes old, and deduplicates provider retries. Calendly retries failed webhook deliveries for up to 24 hours with progressively longer delays and may turn off a persistently failing subscription. Calendly does not expose a reschedule mutation. Invitee results contain rescheduleUrl; send that URL to the invitee when they need to choose another time. See Calendly’s OAuth scopes, API conventions, rate limits, and webhook signatures.