REST API v2
Read and write access to Vacation Tracker for integrations, partner tools, internal tooling and AI agents.
REST API v2 gives integrations, partner tools, internal tooling and AI agents read and write access to your Vacation Tracker workspace. Compared to v1, it adds:
- Scoped keys owned by a user. Each key has only the permissions it needs, and it can never do more than the person who created it.
- Synchronous writes. A write waits until the change is applied and returns the updated resource. If the change takes longer, you get
202 Acceptedand an operation to follow. - Webhooks. Get notified when leaves, users and other resources change.
- AI-friendly errors. Every error has a stable code, a description and a resolution you can act on, or pass straight to an AI agent.
Base URL
https://api.vacationtracker.io/v2Quick start
Create a key in the dashboard (see Authentication), then send it as a bearer token:
curl https://api.vacationtracker.io/v2/departments \
-H "Authorization: Bearer vt_live_..."Response format
A successful call returns the resource, or a list of resources, under data:
{
"data": [...],
"nextToken": "..."
}nextToken is present only on list responses that have more pages.
| Status | When |
|---|---|
200 OK | Read, update or action succeeded. |
201 Created | The resource was created. |
202 Accepted | The write is still running. Follow it in Operations. |
204 No Content | The resource was deleted. Leaves and TOIL requests return 200 OK with the deleted request instead. |
Pagination
The leave, TOIL, user and webhook lists accept limit and nextToken query parameters. Other lists return every item in one response. If a response includes nextToken, pass it unchanged in the next request to get the next page. When it is missing, you have reached the last page.
# First page
curl "https://api.vacationtracker.io/v2/users?limit=100" \
-H "Authorization: Bearer vt_live_..."
# Next page, with the nextToken from the previous response (URL-encoded)
curl --get "https://api.vacationtracker.io/v2/users" \
--data-urlencode "limit=100" \
--data-urlencode "nextToken=$NEXT_TOKEN" \
-H "Authorization: Bearer vt_live_..."Errors
Every error uses the same envelope, with the HTTP status from the error catalog:
{
"error": {
"code": "INSUFFICIENT_SCOPE",
"name": "InsufficientScope",
"description": "The API key does not have the scopes this request needs.",
"resolution": "Add the scopes listed in details.requiredScopes to the key in the Vacation Tracker dashboard.",
"requestId": "...",
"details": { "requiredScopes": ["leaves:write"] }
}
}Branch on code. details is optional and depends on the error. See Errors for every code.
Availability
REST API v2 is available on all paid plans with the Open API add-on. It is not available on the Freemium plan.
v1 keeps working
The v1 API (/v1, x-api-key header) keeps working for existing keys, but it is sealed: it gets no new endpoints, and new keys are v2 keys. v1 keys do not work on v2.
Next steps
Authentication and API keys
Create scoped keys, rotate and revoke them.
Acting on behalf of users
Make changes as another user with X-On-Behalf-Of.
Idempotency
Retry writes safely with Idempotency-Key.
Operations
Follow writes that returned 202 Accepted.
Errors
Every error code, with its description and resolution.
Rate limits
Request limits and how to handle 429.
Webhooks
Receive signed notifications when data changes.
Webhook events
Every webhook event and its payload.
Migrating from v1
Move a v1 integration to v2.
API reference
Every endpoint, parameter and response.
Legacy flow (deprecated)
The original Vacation Tracker OAuth2 hostname at api.app.vacationtracker.io. Kept as a permanent compatibility mapping for existing integrations. New integrations should use auth.vacationtracker.io.
Authentication and API keys
Create scoped v2 API keys, and learn how the role ceiling, expiry, rotation and revocation work.