> ## Documentation Index
> Fetch the complete documentation index at: https://docs.automate.ax/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Automate.ax automations are TypeScript programs.
> Use Bun for installation and command examples.
> Use Automate.ax for the product name and automate.ax for the package, CLI, and domain.
> Treat documented public APIs as current; do not invent transitional or deprecated names.

# Authorization and webhooks

> Understand Calendly OAuth scopes, plan limits, identifiers, pagination, rate limits, and signed webhook delivery.

## Connect Calendly

Calendly uses OAuth with PKCE. Automate.ax requests `users:read` when you connect, then requests the scopes required by the actions and triggers in your deployment. Access tokens expire after two hours. Calendly rotates refresh tokens after every use; Automate.ax stores the replacement atomically.

Actions declare one of these scopes: `users:read`, `organizations:read`, `event_types:read`, `event_types:write`, `availability:read`, `availability:write`, `locations:read`, `scheduled_events:read`, `scheduled_events:write`, `routing_forms:read`, or `scheduling_links:write`. Triggers also require `webhooks:write` and the read scope for their event family. A write scope includes its corresponding read access.

Calendly still applies the connected user's role and plan. Direct invitee booking requires Standard or above. Routing forms and their submissions require Teams or above. Organization-scoped resources and webhooks can require an organization owner or admin.

## Resource identifiers

Calendly returns canonical resource URLs such as `https://api.calendly.com/users/AAAAAAAAAAAAAAAA`. Pass the complete URL to fields named `user`, `organization`, `eventType`, `form`, or `invitee`. Pass only `AAAAAAAAAAAAAAAA` to fields ending in `Id`.

List actions return `{ items, pageInfo }`. Pass `pageInfo.nextPageToken` as `pageToken` to fetch the next page. `count` defaults to 20 and accepts 1–100.

## Rate limits

Calendly permits 500 requests per user per minute on paid plans and 50 on free plans. Direct invitee creation has lower plan-specific limits. Automate.ax retries `429` responses after Calendly's `X-RateLimit-Reset` delay. Other client errors fail the action without retry, while server failures remain eligible for retry.

## Signed lifecycle webhooks

Every trigger needs `organizationUri` and a provider `scope`:

* `organization` watches the organization and needs no additional URI.
* `user` also needs `userUri`.
* `group` also needs `groupUri`.

Routing form submissions and the broad scheduling-event trigger support only organization scope. Semantic event type, invitee, and no-show triggers can use organization, user, or group scope.

Automate.ax combines compatible triggers into one Calendly webhook, reconciles its exact callback URL and event set, and deletes it after the final subscription or account connection is removed. It verifies `Calendly-Webhook-Signature` as HMAC-SHA256 over the exact timestamp and body, rejects deliveries more than three minutes old, and deduplicates provider retries.

Calendly retries failed webhook deliveries for up to 24 hours with progressively longer delays and may turn off a persistently failing subscription.

Calendly does not expose a reschedule mutation. Invitee results contain `rescheduleUrl`; send that URL to the invitee when they need to choose another time.

See Calendly's [OAuth scopes](https://developer.calendly.com/docs/authentication/scopes), [API conventions](https://developer.calendly.com/api-docs/overview/api/api-conventions), [rate limits](https://developer.calendly.com/api-docs/overview/rate-limits), and [webhook signatures](https://developer.calendly.com/api-docs/overview/webhooks/webhook-signatures).