API Endpoints
All requests require X-API-Key header.
| Method | Path | Description |
| GET | /calendar/events | List events |
| GET | /calendar/events/:id | Get event detail |
| POST | /calendar/events | Create event |
| PATCH | /calendar/events/:id | Update event |
| DELETE | /calendar/events/:id | Delete event |
Query Parameters
| Parameter | Required | Description |
calendar_id | Yes | Calendar ID (e.g. user@dable.io) |
delegated_user | Yes | User to act on behalf of |
time_min | No | Start time filter (ISO 8601) |
time_max | No | End time filter (ISO 8601) |
q | No | Search query |
single_events | No | Expand recurring events (true/false) |
order_by | No | Sort order (startTime) |
page_token | No | Pagination token |
Example: List Events
curl -H "X-API-Key: YOUR_API_KEY" \
"https://dablecalendar.letrun.ai/calendar/events?calendar_id=user@dable.io\
&delegated_user=user@dable.io&single_events=true&order_by=startTime\
&time_min=2026-04-01T00:00:00%2B09:00&time_max=2026-04-02T23:59:59%2B09:00"
Example: Create Event
curl -X POST -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
"https://dablecalendar.letrun.ai/calendar/events?calendar_id=user@dable.io\
&delegated_user=user@dable.io" \
-d '{
"summary": "Team Meeting",
"start": {"date_time": "2026-04-02T14:00:00+09:00", "time_zone": "Asia/Seoul"},
"end": {"date_time": "2026-04-02T15:00:00+09:00", "time_zone": "Asia/Seoul"},
"attendees": [{"email": "colleague@dable.io"}],
"conference_rooms": ["room@resource.calendar.google.com"]
}'
Request Body Fields (POST/PATCH)
| Field | Type | Description |
summary | string | Event title |
description | string | Description |
location | string | Location |
start | object | {date_time, date, time_zone} |
end | object | {date_time, date, time_zone} |
attendees | array | [{email, display_name, optional}] |
conference_rooms | string[] | Room resource emails |
visibility | string | public or private |
recurrence | string[] | RRULE recurrence rules |
Security
Only events with explicit visibility: "public" are returned in full.
All other events are masked as "Private Event" with details stripped.
- API Key auth —
X-API-Key header required, keys expire after 1-12 months
- Calendar access control —
*@dable.io wildcard domain matching
- Private event masking — non-public events show only time & free/busy status
- Proxy-created events — tagged in description, extendedProperties, and banana yellow color
- Admin access — @dable.io Google login required