The Developer API is an optional add-on. It lets a custom application read and change Horizon data through a REST interface, using the same permissions the signed-in member already has. Most organizations never need it. Spreadsheet imports and the rest of scheduling stay in the subscription.
Technical request and response details live in the Developer API documentation. Pricing and daily call limits are on API Rate Limits & Pricing. Organization administrators add the add-on from System Settings under Add-Ons. Horizon reviews each request before credentials are issued.
How access works
The application never signs in as Horizon. It asks a member to approve access, then acts on that member's behalf.
The application calls /oauth2/requestCode with the scopes it wants and an HTTPS callback address.
The member opens the returned login link, signs in, and reviews each organization and scope on the approval screen.
Accept returns one authorization code per organization the member left checked. Those codes last 1 year.
The application exchanges a code for an access token through /oauth2/requestToken. Tokens last 30 minutes. Use a new token when one expires. After a year, start the approval again.
See How do I get a Developer access token? for the full sequence.
Scopes and membership roles
A scope is only a request. It does not raise the member's permissions. The application needs the scope, and the member needs the matching role in that organization.
read_organization — read organization structure. Assignors, observers, and organization administrators can grant it.
add_to_organization — add or update organization records, including schedule events. Assignors and organization administrators can grant it.
manage_organization — nearly every organization action. Only organization administrators can grant it.
read_personal_schedule and manage_personal_schedule — the signed-in member's own schedule. Any signed-in member can grant them.
read_personal_account and manage_personal_account — the signed-in member's own account. Any signed-in member can grant them.
The full list, including how applications should handle a refused scope, is in What developer scopes are available?
More than one organization
Many members belong to more than one organization. The approval screen can list each organization that can grant at least one requested scope, and it shows the member's role in each. The member unchecks any organization they do not want this application to use. There is no requestCode option that limits the list to one organization in advance.
Each accepted organization gets its own authorization code. Store and exchange them separately. A later API call uses one access token, so it acts on one organization.
A second affiliation does not block write scopes in the first organization. Write scopes fail only when the member's role in the organization being authorized cannot grant them, or when the member unchecks those scopes.
Adding, updating, cancelling, or deleting events
Use the /schedule resources.
Read or list events with read_organization, add_to_organization, or manage_organization.
Add, update, cancel, or delete events with add_to_organization or manage_organization. Either write scope is enough. You do not need both.
Cancel and delete use the schedule delete resource with operation cancel or delete. Cancel keeps a record and notifies the people on the event. Delete permanently removes an unpublished event. Both are permanent.
If approval says permissions are missing
The approval page says This developer wants permissions that you don't currently have when none of the member's organizations can grant any requested scope. Confirm the member is an assignor or organization administrator in the organization the application needs to change, then request the matching write scope. Free and paid Developer API plans do not hide write scopes. Those plans only change how many calls you can make.
Authorization cannot finish while an administrator is simulating another account. Exit simulation first.
Members can revoke an approved application later from Personal Profile.