Aura Meetings — External API

Real meetings, as a service another system can rely on.

The contract

openapi.yaml — the machine-readable specification. Generate your client from it rather than from prose. If anything you were told contradicts it, the specification is what the server does.

Base URL

https://meetings.auraplatform.org/v1/external

Authentication

Authorization: Bearer <keyId>.<secret>

Per-consumer credentials, issued by an Aura operator. There is no shared secret and no privileged path for any consumer.

Three things worth knowing before you build

Events carry a per-meeting sequence, contiguous from 1. An event type you do not recognise must still be admitted and counted — skipping it breaks contiguity, and after that no meeting on that stream can reach a terminal state.

Verify the webhook signature over the raw bytes, before parsing. The timestamp is bound into the signed material, so a captured delivery cannot be replayed indefinitely.

Retrieval is the authority. An event says something happened; GET /meetings/{id} says what is true now. Both derive from the same source, so reconciliation cannot disagree with the events it repairs.

Status

Early access. Free is a price, not an architecture — customer identity, usage evidence and service status exist from the start; pricing does not yet.