> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraldraft.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Embeddable booking widget script

> Returns a self-contained JavaScript bundle that renders a booking
widget into a host element. Drop into any page:

```html
<div data-nd-booking="12"></div>
<script src="https://api.neuraldraft.io/v1/widgets/booking/12.js" defer></script>
```

The MCP server's `setup_booking_widget` tool returns the URL to this
script. Long-cached on CDN. No auth, no credits.




## OpenAPI

````yaml /openapi.yaml get /widgets/booking/{service_id}.js
openapi: 3.1.0
info:
  title: Neural Draft Project API
  version: 1.0.1
  summary: The AI-native backend platform for Lovable / Claude / v0 / Bolt-built sites.
  description: |
    The **Neural Draft Project API** is the single REST contract every AI-built
    site, MCP server tool call, and SDK in our ecosystem speaks against. One
    project key (`ndsk_live_...`) gets you CMS, blog, social, booking and
    commerce primitives behind a stable v1 surface.

    ## Quick start

    ```bash
    curl https://api.neuraldraft.io/v1/projects/me \
      -H "Authorization: Bearer ndsk_live_yourkey"
    ```

    ## Authentication

    Every endpoint except `GET /health` requires a project API key passed as
    `Authorization: Bearer ndsk_live_...`. Keys are scoped to a single project
    (formerly "tenant"). Resolve the project context by calling
    `GET /projects/me`.

    Keys carry one or more **scopes** (e.g. `content:write`, `commerce:admin`).
    A `403 Forbidden` is returned if the key lacks the scope required by the
    endpoint.

    ## Credits

    Most operations cost credits. Costs are documented per endpoint in this
    spec and on the [pricing page](https://neuraldraft.io/pricing). When a
    project has no credits left, every credit-consuming operation returns
    `402 Payment Required` with `code: insufficient_credits`. The response
    includes `cost` (credits the operation needed) and `balance` (credits the
    project had on hand) so clients can render an exact top-up prompt.

    Read-only endpoints (`GET`) do not consume credits. Mutating writes —
    upserting a content key, creating or updating a page, registering an
    image (URL swap or multipart upload) — cost **1 credit** each on top of
    the AI-generation costs documented per endpoint.

    ## Rate limits

    Default project budget is **60 requests per minute**, burst **120**. Every
    response includes:

    | Header | Meaning |
    |---|---|
    | `X-RateLimit-Limit` | Window ceiling |
    | `X-RateLimit-Remaining` | Requests left in window |
    | `X-RateLimit-Reset` | Unix seconds when bucket refills |
    | `Retry-After` | Seconds to wait, only on `429` |

    Enterprise plans get higher budgets — contact sales.

    ## Async work

    Long-running operations (blog generation, image generation, batch
    translation, content plans, full website generation) return a
    [`Job`](#tag/Jobs) resource immediately with `202 Accepted` and
    `status: pending`. Two ways to track progress:

    1. **Poll** `GET /jobs/{id}` until `status` is one of `completed`,
       `failed` or `cancelled`.
    2. **Stream** `GET /jobs/{id}/stream` for a Server-Sent Events feed of
       `progress`, `step`, `done`, `error` events.

    ## Webhooks

    Outgoing webhooks let your project URL receive events (e.g.
    `order.paid`, `blog_post.published`). Manage delivery URLs at
    [`/webhook-endpoints`](#tag/Webhooks). Every delivery is signed with
    HMAC-SHA256:

    ```
    X-Neural-Draft-Signature: t=1745000000,v1=<hex_hmac_sha256(body, secret)>
    X-Neural-Draft-Event: order.paid
    X-Neural-Draft-Delivery: <uuid>
    ```

    Verify the timestamp is within 5 minutes and the HMAC matches before
    trusting the payload.

    ## Idempotency

    Mutating endpoints accept an `Idempotency-Key` header (any unique string
    up to 255 chars). Retries with the same key within 24 hours return the
    original response without re-executing the side effect.

    ## Errors

    All errors follow [RFC 7807](https://datatracker.ietf.org/doc/html/rfc7807)
    `application/problem+json` shape. The `code` field is a stable machine
    identifier; the `detail` is a human-readable explanation.
  termsOfService: https://neuraldraft.io/legal/terms
  contact:
    name: Neural Draft Support
    email: info@neuraldraft.io
    url: https://neuraldraft.io/support
  license:
    name: Proprietary
    url: https://neuraldraft.io/legal/api-license
  x-logo:
    url: https://neuraldraft.io/assets/logo-dark.svg
    altText: Neural Draft
servers:
  - url: https://api.neuraldraft.io/v1
    description: Production
  - url: https://api.staging.neuraldraft.io/v1
    description: Staging
security:
  - apiKeyAuth: []
tags:
  - name: Health
    description: Liveness, version, and the runtime OpenAPI document.
  - name: Projects
    description: >
      Project (formerly "tenant") metadata, API key management, and credit
      usage.

      Every API key resolves to exactly one project.
  - name: Brand
    description: |
      Canonical brand context — voice, colors, fonts, audience, content tone.
      This is the single source of truth that the MCP server's `brand://current`
      resource exposes to AI codegen tools.
  - name: Content
    description: |
      The CMS pillar. Translation keys map `dot.notation` keys to per-language
      values. Use `bulk` for build-time fetches of many keys at once.
  - name: Components
    description: >
      Editable HTML chunks registered by AI codegen tools during a build
      session.

      A registered component becomes editable in the project's admin UI.
  - name: Pages
    description: |
      Multi-page authoring with per-page SEO meta (meta_title, meta_description,
      og_*, canonical_url). Pages live alongside the components that render
      them.
  - name: Galleries
    description: |
      Named, ordered image collections. One `slug` per gallery, an `items`
      array of `{url, alt}` (max 200). Updates are full-replace — fetch,
      mutate, send the complete new list back. Use for carousels, lookbooks,
      product galleries, and any other variable-length image set.
  - name: Images
    description: Brand-consistent image generation, replacement, and resolution by key.
  - name: Blog
    description: |
      Full blog engine — posts, categories, tags, scheduling, multi-language
      translation, AI authoring pipeline.
  - name: Social
    description: |
      Social pillar — multi-platform post generation, scheduling, publishing,
      OAuth account connections.
  - name: Booking
    description: |
      Booking pillar — bookable services, weekly availability, slot lookup,
      bookings (admin + public), embeddable widget.
  - name: Commerce
    description: |
      Commerce pillar — products, variants, categories, orders, Stripe
      Checkout, Stripe Connect onboarding, embeddable widgets.
  - name: Jobs
    description: |
      Async work tracking. Every long-running AI op (blog gen, image gen,
      translation, content plan, website gen) returns a Job. Poll or stream.
  - name: Webhooks
    description: |
      Outgoing webhooks. Subscribe a URL to events your project cares about.
      All deliveries signed with HMAC-SHA256.
  - name: Forms
    description: |
      Lead-capture surfaces — newsletter subscribe and contact-form submit.
      Public submit endpoints (no auth, project resolved via
      `X-NeuralDraft-Project-Key` or `?project_id=`); admin list/delete
      endpoints require an API key with `forms:read` / `forms:write` scope.
      No credits charged — this is storage + delivery, not AI.
paths:
  /widgets/booking/{service_id}.js:
    parameters:
      - in: path
        name: service_id
        required: true
        schema:
          type: integer
    get:
      tags:
        - Booking
      summary: Embeddable booking widget script
      description: >
        Returns a self-contained JavaScript bundle that renders a booking

        widget into a host element. Drop into any page:


        ```html

        <div data-nd-booking="12"></div>

        <script src="https://api.neuraldraft.io/v1/widgets/booking/12.js"
        defer></script>

        ```


        The MCP server's `setup_booking_widget` tool returns the URL to this

        script. Long-cached on CDN. No auth, no credits.
      operationId: getBookingWidget
      responses:
        '200':
          description: JavaScript bundle.
          content:
            application/javascript:
              schema:
                type: string
              example: |
                /* @neuraldraft booking widget v1 */
                (function(){ /* … */ })();
        '404':
          $ref: '#/components/responses/NotFound'
      security: []
      x-codeSamples:
        - lang: curl
          label: cURL
          source: >
            curl https://api.neuraldraft.io/v1/widgets/booking/12.js -o
            booking.js
        - lang: node
          label: Node
          source: >
            // No SDK call — embed the URL directly in your HTML.

            // <script src="https://api.neuraldraft.io/v1/widgets/booking/12.js"
            defer></script>
        - lang: python
          label: Python
          source: |
            # No SDK call — embed the URL directly in your HTML.
        - lang: php
          label: PHP (Blade)
          source: >
            <script src="https://api.neuraldraft.io/v1/widgets/booking/{{
            $serviceId }}.js" defer></script>

            <div data-nd-booking="{{ $serviceId }}"></div>
components:
  responses:
    NotFound:
      description: The resource does not exist (or this key cannot see it).
      headers:
        X-Request-Id:
          schema:
            type: string
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            missing:
              value:
                type: https://api.neuraldraft.io/errors/not_found
                title: Not found
                status: 404
                detail: No such resource.
                code: not_found
                instance: req_2Nh4PqRsTuVw
  schemas:
    Error:
      type: object
      description: |
        RFC 7807 problem+json error. The `code` is a stable machine
        identifier; clients should branch on `code`, never on `title`.
      required:
        - type
        - title
        - status
        - code
      properties:
        type:
          type: string
          format: uri
          example: https://api.neuraldraft.io/errors/validation_failed
        title:
          type: string
          example: Validation failed
        status:
          type: integer
          example: 422
        detail:
          type: string
          example: One or more fields failed validation.
        instance:
          type: string
          description: Request id (also returned as `X-Request-Id` header).
          example: req_2Nh4PqRsTuVw
        code:
          type: string
          description: |
            Stable machine error code. Standard values:
            `bad_request`, `unauthorized`, `insufficient_credits`,
            `forbidden`, `not_found`, `conflict`, `validation_failed`,
            `rate_limited`, `internal_error`, `service_unavailable`,
            `slot_unavailable`, `connect_not_ready`, `upstream_unavailable`,
            `idempotency_conflict`.
          example: validation_failed
        cost:
          type: integer
          description: |
            Credits the operation requires. Only present on
            `402 insufficient_credits` responses.
          example: 1
        balance:
          type: integer
          description: |
            Credits the project had on hand at the time of the request.
            Only present on `402 insufficient_credits` responses.
          example: 0
        errors:
          type: object
          description: Field-level validation errors (only on 422).
          additionalProperties:
            type: array
            items:
              type: string
          example:
            customer_email:
              - The customer email field must be a valid email.
            starts_at:
              - The starts at field must be a valid ISO 8601 date.
  securitySchemes:
    apiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: |
        Project API key. Pass as `Authorization: Bearer ndsk_live_...`. Manage
        keys via [`/projects/me/api-keys`](#tag/Projects). Test-mode keys use
        the `ndsk_test_` prefix.

````