Tripleseat API: Automate BEOs, Deposits, and Follow-Up
The BEO is signed at 8:12pm. Carly can confirm it with the client, send the final counts and dietary notes to the kitchen, update staffing, and surface whatever is still missing before morning. From the first inquiry through the deposit and final follow-up, Carly carries Tripleseat’s event data into the communication and handoffs the venue actually has to perform.
A Tripleseat customer admin can create their own OAuth 2.0 application and get a client ID and secret without talking to anyone. That’s worth stating plainly, because searching for this turns up a lot of “Tripleseat’s API is partner-only,” and it isn’t.
The confusion is real but explainable. There are two tiers. A private app works against your own account and is fully self-serve. A public app, distributed to other venues, is provisioned by Tripleseat’s partnership team. If you’re a venue automating your own operation, you want the private app, and nobody needs to approve it.
What venues actually automate with it
The two events worth building on are the two that move money:
- A signed BEO that tells the kitchen. The contract comes back signed and the final counts, dietary notes, and timing reach the kitchen and staffing lead automatically — instead of waiting for the event manager to forward it Monday.
- A deposit that clears the booking. Payment lands and the confirmation goes out immediately, rather than the client wondering for two days whether they’re actually booked.
- New leads answered fast. An inquiry arrives Friday evening and gets a real response before the competing venue opens Monday. In event sales, response time is close to the whole game.
- Guest count changes that reach the kitchen rather than surfacing the morning of.
Tripleseat fires an event for every one of these. What’s usually missing is anything on the other end.
The one thing that breaks every old tutorial
OAuth 1.0 shut down on July 1, 2026. Requests using it now return a bespoke 410.
That was three weeks ago, which means essentially every Tripleseat integration tutorial, Stack Overflow answer, and HMAC-SHA1 code sample published before 2026 is dead. If you’re following a guide that has you signing requests with a consumer key and secret, stop — that’s the retired flow.
Creating your app
Settings → Tripleseat API & Webhooks (under Resources) → Tripleseat API OAuth 2.0 Client Applications → View or Edit Client Applications → + New Application. Fill in name, description, information URL, redirect URL, and the scopes you need. Save, then copy the UID (your client ID) and Secret.
Two constraints worth knowing before you start:
- Only a customer admin can authorize. Regular users can’t, and people routinely discover this halfway through the OAuth flow.
- Scope selection is slightly ambiguous. The self-serve flow lets you pick “your required application scopes,” while partner documentation says to request only scopes your app was approved for and contact Tripleseat for more. Whether a self-created private app can select the full scope list isn’t documented. Assume you may need to ask.
The mechanics:
- Authorize at
https://login.tripleseat.com/oauth2/authorize, exchange athttps://api.tripleseat.com/oauth2/token - Base URL
https://api.tripleseat.com/v1/ - Bearer tokens live 2 hours; refresh tokens rotate, so the old one is invalidated on use
- Rate limits are three-layer: 10/second, 1,200/minute, 18,000/hour
- Scopes look like
leads:write events:read
There’s a second auth mode using a public_key query parameter, but it only works for lead-form and locations endpoints.
Tripleseat publishes no public pricing at all, and none of its API documentation mentions plan gating. Nothing suggests API access is a paid add-on, but it can’t be verified either — worth confirming with your account rep if it’s load-bearing for you.
The published spec points at a dev server
The OpenAPI spec is genuinely public — https://api.tripleseat.com/api-docs/v1/openapi.yaml returns 264KB with no auth, covering 67 paths.
But its servers: block has no production entry. It lists only http://api.dev.tripleseat.com:3000, an ngrok host, and a staging server. Run openapi-generator against it and you get a client pointed at Tripleseat’s development box. Hardcode https://api.tripleseat.com/v1/ yourself.
That’s a live bug in the file, not a misreading of it, and it’s the kind of thing that costs an hour of confused debugging.
What you can write
Full CRUD on leads, events, bookings, contacts, and accounts — plus notes on all of them and task creation.
Read-only: locations, menus, rooms, sites, users, lead forms, payment and credit-card reports, menu item selections. Guest room blocks support create and update for hotel properties.
Documents are effectively read-only. The only write is PATCH /v1/documents/{id}/billing_amount — there’s no document creation through the API, which surprises people expecting to generate BEOs programmatically.
The webhooks are the strongest part
Fifty-plus triggers, configurable in the UI and programmatically via /v1/sites/{site_id}/webhook_endpoints, signed with HMAC-SHA256 as X-Signature: t=timestamp,v1=hash.
The catalog, grouped:
- Events — create, update, delete, status change, datetime change, guest count change, and reassignment of location, areas, ownership, contact, and account
- Leads — create, create internal, convert, convert to booking, turned down
- Bookings — create, delete, status change, date change, note created, task created, and reassignment of account, contact, ownership, location
- Documents — create, update, delete, and share for booking and event documents, plus document signed
- Payments — payment shared, payment paid
- Contacts and accounts — contact create, update, delete; account update
- Rooms — create, update
- DirectBook — create, accept, reject, terms accepted
- Guest room blocks — create, update, delete (hotels)
DOCUMENT_SIGNED and PAYMENT_PAID are the two most useful in practice — contract signed and deposit received are exactly the moments where follow-up should be automatic and usually isn’t.
One quirk: Tripleseat’s own docs misspell the direct-book rejection event as REJECT_DRIECT_BOOKING. That’s likely the literal string, so match it as written.
Webhooks are site-level, not location-level. A multi-venue operator receives every location’s events on one endpoint with no server-side filter — you filter on the payload yourself. Endpoints also auto-disable after repeated delivery failures; re-enable via the UI or the /enable endpoint.
Three more traps
- There is no Tripleseat Zapier app. This gets asserted a lot, and it’s false —
zapier.com/apps/tripleseat/integrationsreturns a 404, Tripleseat’s help center has zero Zapier articles, and its partner marketplace doesn’t mention Zapier anywhere. Don’t plan around it. - Payment data is silently absent unless you toggle
include_event_financialson, per endpoint. It’s off by default, so financial fields just aren’t there and nothing tells you why. site_idis required on every call for multi-site accounts — optional only if you have exactly one active site. Enumerate them withGET /v1/sites.
Also worth knowing: webhooks evaluate at the data-model level, so a UI save that changes nothing fires nothing. Useful when you’re testing and wondering why the event never arrived.
Getting the event to do something
A signed contract and a received deposit are the two moments in event sales where speed is worth actual money, and both fire a webhook. What’s usually missing is anything listening.
Handing it to an AI assistant runs into a specific limit.
ChatGPT Scheduled Tasks and Claude Cowork both run unattended on timers. Their ordinary task schedulers do not subscribe directly to arbitrary events in connected business apps. ChatGPT Workspace Agents can be invoked through an API, but an upstream system must still detect the event and call it.
“Summarize this month’s bookings” is well within what ChatGPT or Claude will do with a Tripleseat export. “The moment a BEO is signed, send the kitchen the final counts and schedule the staffing” is not, because nothing on that side is watching for the signature.
Carly is built for that half:
- Fires on the Tripleseat event — document signed, payment paid, lead created, guest count changed
- Runs the whole response in one flow — read the event, pull the contact and account, draft the message, send it, log a note back
- Actually sends — Gmail and Outlook, with attachments
- Handles the site-level filtering — routing one shared webhook stream to the right venue’s workflow is exactly the tedious plumbing worth automating
Because Tripleseat exposes a public API, you can connect it natively to Carly from the Integrations tab. Carly can then use Tripleseat in on-demand, recurring, and event-triggered workflows. AI agents start at $35/month, and workflow steps that don’t use AI run free.
Frequently Asked Questions
Can I get Tripleseat API credentials without being a partner?
Yes. A customer admin creates a private OAuth 2.0 application in Settings → Tripleseat API & Webhooks and gets a UID and secret immediately. Only public apps — the kind distributed to other venues — are provisioned by Tripleseat’s partnership team.
Does Tripleseat still support OAuth 1.0?
No. OAuth 1.0 was shut off on July 1, 2026, and requests using it return a 410. Any tutorial or code sample using HMAC-SHA1 consumer keys is out of date.
What is the Tripleseat API rate limit?
Three layers: 10 requests per second, 1,200 per minute, and 18,000 per hour. Access tokens expire after two hours and refresh tokens rotate on use.
Does Tripleseat work with Zapier?
No. Despite frequent claims otherwise, Tripleseat has no Zapier app — the Zapier listing returns a 404 and Tripleseat’s own help center and partner marketplace never mention it. Use the API and webhooks directly.
What webhooks does Tripleseat support?
More than 50, covering events, leads, bookings, documents, payments, contacts, accounts, rooms, DirectBook, and guest room blocks. Document signed and payment paid are the most commonly useful. They’re HMAC-SHA256 signed and configurable through the API as well as the UI.
Why is payment data missing from my Tripleseat API responses?
The include_event_financials flag is off by default and set per endpoint. Turn it on and the financial fields appear.
More: Best AI tools for event planners · Best AI tools for restaurants · Best AI workflow automation tools
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
