Jul 20, 2026

Mindbody API: Metered Calls, Free Webhooks, Four Gates

A 6am cancellation does not have to leave a paid spot empty. Carly can offer it to the waitlist, handle the reply, and keep the schedule moving. Around the same Mindbody data, Carly can follow up on failed payments, turn a first visit into a thoughtful next touch, reach clients before contracts lapse, and brief the owner on demand, on a schedule, or from a configured event.

Mindbody meters API calls, and almost nobody writing about this mentions it. Calls are billed per-call on a monthly cycle with a free allowance below a set volume. Widely-cited figures put the rate at $0.002 per call with roughly 5,000 calls free per billing cycle — but Mindbody publishes the current rates inside its developer portal rather than on a public page, so confirm your own numbers there before budgeting against them.

There’s no volume discount. Mindbody’s FAQ answers “Do you offer scaled or bulk API pricing?” with “Not at this time.”

What is clearly documented, and matters more: webhook subscriptions are not counted as API calls. So the metering pushes you toward an event-driven design, which happens to also be the better one. For a single studio automating its own operation, staying inside the free allowance is realistic. For a chain, there’s a billing trap below that changes the math faster than you’d expect.

What studios actually automate with it

The jobs that pay for themselves, all of which Mindbody already knows about:

Filling cancellations from the waitlist. Someone drops out of a full class at 6am. Right now the spot often goes empty because nobody was awake to offer it. The cancellation itself can text the waitlist.
Catching failed contract payments early. A membership payment fails and the member doesn’t find out until they’re turned away at the door — which is how a billing hiccup turns into a cancellation.
First-visit follow-up that actually happens. A new client books their intro class and the follow-up depends on whoever is working the desk remembering.
Contracts approaching their end date, reached before they lapse rather than after.

Because webhook subscriptions aren’t billed as API calls, all four are also the cheapest way to build on Mindbody — reacting costs nothing, checking repeatedly does.

Getting to live access takes four gates

Sandbox is self-serve and free. Production is not one click, and the sequence matters:

Create a developer account at /Home/SignUp — self-serve
Build against the sandbox — free, Site ID -99, calls never counted
Request Live Access — a form plus billing information, then Mindbody manually reviews it and emails you on approval
Request a per-site activation code — Account → Site activation, entering the studio’s Site ID
The studio owner activates it — they click the link and sign in with the owner account, or enter the code under Manager Tools → Mindbody Add Ons → API Integrations

So four distinct gates: Mindbody’s review, a credit card on file, a site-specific code you request per studio, and an action only the studio owner can take. Steps four onward can be partly automated with the GetActivationCode endpoint, but the owner’s activation can’t be.

One irreversible detail: the business name you enter at signup becomes your permanent SourceName. It can’t be changed afterward, and it’s shown to end users on staff reports, consumer receipts, OAuth consent screens, and the studio’s own API Integrations page. Pick it deliberately.

Worth noting what isn’t a gate: the studio’s subscription tier. Mindbody states the Public API is available to developers partnering with business owners “on all subscription levels.” The review is on your side, not theirs.

Auth, and the version to build on

Base URL https://api.mindbodyonline.com/public/v6/, current version Public API V6.0
Headers: Api-Key plus SiteId (one site per request) plus Authorization: {staffUserToken}
Get the staff token from POST UserToken/Issue. A token only works with the API key that minted it, and staff permissions change what comes back.
Rate limit: Mindbody recommends staying at or under 2,000 requests per minute; over that returns 429. Rate-limited requests aren’t billed.
Pagination defaults to 100, max 200.
Up to 10 API keys per account, with inactive keys counting toward the cap.

Build new integrations on V6. Mindbody has limited new developer accounts to V6 since February 2020, and V6 does not use the legacy SourceCredentials auth pattern. Mindbody’s July 2026 release notes still describe behavior applying to both V5 and V6, so it is inaccurate to say every V5 integration shut down in January 2026. The practical rule is simpler: use the current V6 docs and do not copy a legacy V5 authentication example into a new build.

OAuth 2.0 is supported but isn’t self-serve: “For OAuth client creation, please Contact API Support.”

The billing trap

Billing is per location. Permissioning is per Site ID. Those aren’t the same thing, and one Site ID can cover many locations.

Mindbody spells out the consequence: connect your integration to a Site ID representing several locations and “you will incur API fees for all locations represented by that Site ID.” A studio group that looks like one connection can bill like eight. You can remove sites under Account → Site Permissions.

Two more costs worth knowing: a custom sandbox is a one-time charge (the public sandbox is free but wipes nightly). And if you’re building something that books across multiple Mindbody businesses — an aggregator, not a single-studio tool — a separate consumer-booking network fee applies per location and per booking.

One widely-repeated figure to ignore outright: “1,000 calls per day” comes from Mindbody’s retired 2022 pricing model. It’s stale, and it’s the clearest sign a page hasn’t been updated in years. Given how much stale Mindbody pricing is in circulation, treat every figure you find outside the developer portal — including the ones here — as needing confirmation.

Webhooks are the cheap path — and they are not counted as calls

This is the most useful fact in the whole surface: webhook subscriptions don’t count as API calls and aren’t charged. Mindbody’s FAQ puts it plainly — “You can subscribe to as many webhook events as you would like.”

So the expensive way to know something happened is polling. The free way is subscribing. That’s a rare case where the cheaper architecture is also the better one.

The catalog covers:

Appointments — booking created, updated, cancelled; add-on created
Classes — schedule created, updated, cancelled; class updated; description updated
Class roster — booking created, cancelled; booking status updated
Waitlist — request created, cancelled
Clients — created, updated; profile merger created
Memberships — assignment created, cancelled
Contracts — created, updated, cancelled
Sales — client sale created
Site — created, updated; business day closure created, cancelled
Location — created, updated
Staff — created, updated
Pick a Spot reservations — created, updated, removed (added in June 2026)

Mechanics: POST to https://mb-api.mindbodyonline.com/push/api/v1/subscriptions to create, then PATCH to activate — subscriptions are inactive until activated. Payloads are signed with X-Mindbody-Signature, HMAC-SHA256, base64, prefixed sha256=.

The delivery semantics need designing around. Events are at-least-once and unordered — Mindbody says outright they’re “not guaranteed to be delivered only once” and “not guaranteed to be delivered in chronological order.” You have 10 seconds to respond; failures retry every 15 minutes for 3 hours, then drop permanently. Nothing is replayed to an inactive subscription. Repeated failures auto-deactivate you.

So: idempotent handlers, no assumptions about sequence, and fast acknowledgement with async processing.

One nice touch — your own API writes fire webhooks too (a POST UpdateClient dispatches client.updated), and a transaction key lets you trace and suppress your own echo events.

It genuinely writes

Clients (add, update, arrivals, formula notes, documents, photos, contracts, direct debit), classes (schedules, adding and removing clients, waitlists), appointments (single, multiple, add-ons, availability), sales (cart checkout, contract and gift card purchase, returns, product pricing), staff (add, update, permissions), and site-level things like promo codes and client indexes.

Card processing works but needs an active Mindbody merchant account through one of a fixed list of processors, and it’s geographically limited.

Three things that will bite

Request deduplication returns 409 silently. AddAppointment and AddClientToClass fingerprint your credentials, endpoint, and exact payload. An identical in-flight request gets 409 Conflict instead of a booking, for up to two minutes. Two legitimately identical back-to-back bookings will collide. Bypass with X-RequestDeduplication-Skip: true.
The Test: true parameter still bills. It validates without committing, but the call counts.
Branding is mandatory. An approved Mindbody logo has to appear on any page displaying API-sourced data, sized smaller than both the studio’s logo and your own.

Also: Booker is a different product with a different API, despite being Mindbody-owned. Mindbody’s own FAQ confirms usage reports don’t span the two. ClassPass, same parent company, is a separate consumer marketplace entirely.

Run the Mindbody work through Carly

A new client, a cancelled booking, a contract about to lapse — each fires a webhook, free of charge, and in most studios each is handled by whoever notices first.

Handing that to an AI assistant runs into a specific wall.

The unattended-work gap closed when ChatGPT and Claude Cowork added scheduled runs. Their standard schedulers still start from the clock, not arbitrary events in connected apps; API-triggered ChatGPT Workspace Agents require an external event detector and caller.

“Summarize last month’s retention” is comfortably within what ChatGPT or Claude will do with a Mindbody export. “Text the client and offer the waitlist spot the moment someone cancels” is not, because nothing on that side is watching for the cancellation.

Carly connects directly to Mindbody for the front-desk work people otherwise do by clicking through the app. Email or text Carly to book a client into a class, add a new client, check a membership, or pull class times and headcounts. That is the immediate assistant use case, and it works without building a webhook receiver first.

For repeatable work, Carly workflows can run in two additional ways:

On a recurring schedule. Every morning, pull the day’s classes and headcounts and email the front desk a digest. Each week, check upcoming contract end dates and prepare the outreach list.
From a configured Mindbody event. Point a Mindbody webhook subscription at a workflow webhook endpoint. A cancellation event can start a flow that retrieves the booking details, prepares the appropriate waitlist outreach, sends it through Gmail or Outlook, and records the result. This requires setting up and activating the Mindbody subscription; connecting the account alone does not subscribe Carly to every event.

Webhook delivery itself is not metered, but any Public API reads or writes the workflow makes afterward can still count as billable calls. So event-driven design reduces polling—it does not make the entire response free.

Carly’s non-AI workflow steps are free; AI agents start at $35/month. See the Mindbody integration and the full integration catalog.

Frequently Asked Questions

How much does the Mindbody API cost?

Calls are metered and billed monthly, with a free allowance below a set volume — commonly cited as $0.002 per call with about 5,000 free per cycle, though Mindbody publishes current rates inside the developer portal rather than publicly, so verify there. Webhook subscriptions aren’t counted as calls and aren’t charged, and sandbox calls are always free. There’s no bulk or scaled pricing.

Do I need a specific Mindbody plan to use the API?

No. Mindbody states the Public API is available to developers partnering with business owners on all subscription levels. The gates are on the developer side: an application review, billing details, and a per-site activation the studio owner performs.

How do I get Mindbody API access?

Create a developer account, build against the free sandbox, then request Live Access with billing information and wait for Mindbody’s manual review. After approval, request an activation code for each studio’s Site ID, which the studio owner activates from Manager Tools → Mindbody Add Ons → API Integrations.

What webhooks does Mindbody support?

Events across appointments, classes, class rosters, waitlists, clients, memberships, contracts, sales, sites, locations, staff, and Pick a Spot reservations. Delivery is at-least-once and unordered, requires a response within 10 seconds, and retries for three hours before dropping.

Which Mindbody API version should I use?

Use Public API V6 for a new integration. New developer accounts have been limited to V6 since February 2020, and its authentication differs from legacy V5 examples that use SourceCredentials. Mindbody’s July 2026 release notes still reference both V5 and V6, so do not treat January 31, 2026 as a universal V5 shutdown date.

Why am I being billed for locations I didn’t connect?

API fees are charged per location, but permissions are granted per Site ID — and a single Site ID can represent many locations. Connecting to a multi-location Site ID incurs fees for all of them. Remove unwanted sites under Account → Site Permissions.

More: Best AI tools for fitness studios · Claude + Mindbody · Best AI workflow automation tools

Ready to automate your busywork?

Carly schedules, researches, and briefs you—so you can focus on what matters.

See what people say

"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.

Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.

On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."

Gus Ibrahim, Founder & Director, IHR