Vacation Tracker Docs
REST API v2API referenceOperations

Get an operation

This API method returns the status of an asynchronous write operation, as returned in the `operation` of a `202 Accepted` response or the `Location` header. No scope is required, but a key can only read operations it created. Poll it until `status` is `SUCCEEDED` or `FAILED`; a `FAILED` operation carries an `error` with the catalog code the write failed with, and `resource.url` points to the affected resource when it is known. `X-On-Behalf-Of` is ignored. Errors: `404 RESOURCE_NOT_FOUND` (the operation does not exist, or was created by another key).

GET
/v2/operations/{id}

Authorization

bearerAuth
AuthorizationBearer <token>

API key sent as Authorization: Bearer vt_live_<secret>. See the Authentication and Scopes sections at the top of this document for how keys are created, which scopes exist and how the key owner's role limits them.

In: header

Path Parameters

id*string

operation ID, as returned in the operation.id field of a 202 response.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v2/operations/pa_3f1c2b9e-8a47-4d5e-9c61-2b7f0e4a1d93"
{
  "data": {
    "id": "pa_3f1c2b9e-8a47-4d5e-9c61-2b7f0e4a1d93",
    "status": "SUCCEEDED",
    "action": "leaves.approve",
    "createdAt": "2026-09-23T10:00:00.000Z",
    "completedAt": "2026-09-23T10:00:02.000Z",
    "actingAsUserId": "user-63b17e97-d38b-4586-8498-bb4f5d2e2c14",
    "resource": {
      "type": "leave",
      "id": "leaveRequest-cfe5d39b-f1f0-45aa-85cd-ce93e637a262",
      "url": "/v2/leaves/leaveRequest-cfe5d39b-f1f0-45aa-85cd-ce93e637a262"
    }
  }
}
{
  "error": {
    "code": "UNAUTHORIZED",
    "name": "Unauthorized",
    "description": "The API key is missing, malformed or not recognized.",
    "resolution": "Send a valid API key in the Authorization header as Bearer followed by the full vt_live_ key.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}

{
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "name": "InsufficientScope",
    "description": "The API key does not have the scopes this request needs.",
    "resolution": "Add the scopes listed in details.requiredScopes to the key in the Vacation Tracker dashboard.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef",
    "details": {
      "requiredScopes": [
        "leaves:write"
      ]
    }
  }
}

{
  "error": {
    "code": "RESOURCE_NOT_FOUND",
    "name": "ResourceNotFound",
    "description": "The requested resource does not exist or is outside the data this key can access.",
    "resolution": "Check the ID of the resource named in details.resource and that the key owner can see it.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}
{
  "error": {
    "code": "RATE_LIMITED",
    "name": "RateLimited",
    "description": "Too many requests were sent in a short time.",
    "resolution": "Wait a few seconds and retry, using the same Idempotency-Key for writes.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}
{
  "error": {
    "code": "INTERNAL_ERROR",
    "name": "InternalError",
    "description": "Something went wrong on our side.",
    "resolution": "Retry later, and if it keeps happening, contact Vacation Tracker support and quote the requestId.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}

Need help?

developers@vacationtracker.io

Delete a scheduled report

This API method deletes a scheduled report. Requires `notifications:write`. No request body. The acting user is the key owner, or the `X-On-Behalf-Of` user; it must be an admin, or a location admin who manages every location of the report. It waits for the deletion and returns `204`, or `202 Accepted` with an operation to poll. Errors: `403 SCHEDULED_REPORTS_NOT_AVAILABLE`, `403 ON_BEHALF_OF_NOT_ALLOWED`, `403 FORBIDDEN` (the acting user is neither an admin nor a location admin), `404 RESOURCE_NOT_FOUND` (the report does not exist or is outside the acting user's locations), and the `Idempotency-Key` codes.

List webhooks

This API method returns the webhooks the key owner can see. Requires `webhooks:read`. Admins see every webhook in the company; other users see only the webhooks they own. Webhooks follow the key owner, not the key, so `X-On-Behalf-Of` is ignored. The list is paginated: 25 webhooks per page by default, up to 100 with `limit`. When `nextToken` is present, pass it back to get the next page. The signing secret is never returned here; `secretPrefix` helps you tell secrets apart. Errors: `400` when `limit` or `nextToken` is invalid (see `BadRequest`), and `403 FORBIDDEN` (the key owner no longer exists).