Guest Calendar Connect (Google) — legacy
Deprecated
**Legacy.** Use `POST /v1/calendars/google/connect-guest-link`. This form takes a raw `principal_id` in the URL, so anyone who knows the ID can start a connect. It stays available only for embeds that existed before the link endpoint; other businesses get `410 connect_guest_link_required`. Creates a guest user and redirects to Google OAuth. **Public Endpoint**: No authentication required. **Use Case**: A business's end-customer connects their Google Calendar without needing a Vennio account. The endpoint creates a throwaway guest user, then internally mints a connect token and redirects through the standard token-gated Google OAuth flow. **Security**: `redirect_url` is validated against a hard-coded platform domain allowlist and a per-business `business_redirect_uris` whitelist. External URIs not on either list are rejected with 400. **Result**: when the guest finishes, Vennio creates an active connection between the guest and the business (the connection counts as consent for availability reads) and reports the guest's principal ID two ways: - **Webhook** `consent.granted` to the business, with `grantor_id` (the guest), `grantee_id` (the business), `source: "calendar_connect"`, `connection_id`, `consent_id`, `scopes` and your `reference`. Treat this as the source of truth. - **Redirect**: `redirect_url` gains `google_connected=true`, `principal_id` and `reference`. The URL can be forged by anyone who knows your redirect URL. Confirm the principal against the webhook or `GET /v1/network/connections` before trusting it.
Auth required: No
principal_id (query, string) (required) — UUID of the business whose calendar the guest is connecting to. Also accepts `business_id` (alias).business_id (query, string) — Alias for `principal_id`. Send either, not both.redirect_url (query, string) — URL to redirect after OAuth completes. Must be `https:` (or `http:` on localhost), have no fragment, and be on the business's redirect URI whitelist. Other schemes return `400 invalid_redirect_url`.reference (query, string) — Your own identifier for this connect (e.g. a trip or user ID), echoed back
on the redirect and in the `consent.granted` webhook. Opaque to Vennio.
1-128 characters: letters, digits, `.`, `_`, `:`, `-`.
302: Redirect to Google OAuth consent screen400: Invalid request (missing principal_id, invalid_business when principal_id is not a lower- or upper-case v4 UUID of a business, invalid redirect_url, redirect_url not whitelisted, or invalid_reference)410: `connect_guest_link_required`: this business must use `POST /v1/calendars/google/connect-guest-link`.429: Rate limit exceeded (5 requests per minute or 20 per hour per IP, or 50 requests per hour per business). `Retry-After` gives the seconds until the window resets.This endpoint does not require authentication.
Base URL: https://api.vennio.app