# Built for agents

Hand these docs to your AI assistant.

Everything in this reference is also published as a spec and as plain text, so a coding agent can read it the way you do — and connect your clinic software to Docly while you watch.

## 1. The spec

The machine-readable description of every endpoint, parameter and webhook event in this reference: [https://developers.docly.duckdns.org/openapi.json](/openapi.json) (OpenAPI 3.1).

## 2. llms.txt

A plain-text map of these docs: [https://developers.docly.duckdns.org/llms.txt](/llms.txt).

## 3. A prompt to start with

```text
Integrate Docly webhooks using the spec at developers.docly.in/openapi.json. Verify each delivery with HMAC-SHA256 over timestamp.body using the signing secret, and reject anything older than five minutes. Order events by sequence, never by arrival — retries mean deliveries can arrive out of order.
```

- It checks every delivery came from Docly: HMAC-SHA256 over timestamp.body, with the signing secret.
- It refuses anything older than five minutes, so a captured delivery can’t be replayed.
- It orders events by sequence, never by arrival.

## What an agent can do with your key

- Read your queues and each queue’s live state
- Read visits, token by token, and the daily summary for any day
- Receive signed webhook events as the queue moves
- Check each delivery with your signing secret

## What it can’t do

- Call, skip or complete a token
- Open, pause or end a session
- See a patient’s mobile number
- Read anything without your API key

Your API key lives in Docly Desk: Settings › Developers › Create an integration. The key and the signing secret are shown once.