---
title: "Get what the booking provider can do"
method: GET
path: "/api/bookings/capabilities"
tags: ["Bookings"]
---

# Get what the booking provider can do

`GET /api/bookings/capabilities`

## Request

- Base URL: `https://api.setluca.com`
- URL: `https://api.setluca.com/api/bookings/capabilities`
- Auth: API key in cookie `luca.session_token`

What each booking operation does through the coach's provider, direct, by handoff or not at all, and which booking fields can be edited. Without a booking id, the answer lists every provider. With one, it lists only that booking's provider, or nothing when Luca does not manage that provider.

**Session-only.** This endpoint isn't on the API-key allowlist. An organization API key gets a 403 here, whatever scopes it holds.

## Query parameters

- `bookingId` string, uuid

## Headers

- `Luca-API-Version` '1'

## Response `200`

ok

- BookingCapabilitiesResponse
  - `capabilities` object[], required
    - `provider` string, required
    - `operations` object[], required
      - `operation` string, required
      - `support` 'direct' | 'handoff' | 'unsupported', required
    - `editableFields` string[], required

## Other responses

- `401`: unauthorized
- `403`: forbidden
- `404`: not found
- `429`: rate limited
- `500`: internal error

---

[API](https://skmtc.dev/setluca/apis/luca-api.md) · [All operations](https://skmtc.dev/setluca/apis/luca-api/llms.txt) · [OpenAPI document](https://skmtc.dev/setluca/apis/luca-api/revisions/90a200e4100b?raw)