Skip to main content

Magic Links

Magic links provide time-bound, secure access to meeting room devices for booking organizers.

POST /api/magic-links/issue
x-api-key: <api-key>
Content-Type: application/json

{
  "booking_id": "bk-abc123",
  "physical_space_id": "ps-xyz789",
  "organizer_email": "john@example.com",
  "start_time": "2025-01-15T10:00:00Z",
  "end_time": "2025-01-15T11:00:00Z",
  "check_device_health": true
}

The organization_id is automatically derived from the X-Org-Api-Key header.

What the Guest Sees​

When a guest opens their magic link, they see:

  • Room information — Name, location, booking time
  • Device tiles — One tile per visible adapter (door lock with unlock button, Wi-Fi credentials, etc.)
  • Real-time status — Live device state updates

Security​

  • Magic links expire at the booking end time
  • Each link is cryptographically signed
  • Links are single-use for device credential generation
  • Device access is revoked when the booking ends

Booking Access Flow​

  1. Booking is created in ZenCore
  2. At T-15 minutes, booking.start webhook fires
  3. ZenCore resolves the physical space mapping
  4. ZenCore calls ZenEdge POST /api/magic-links/issue
  5. ZenEdge checks device health (check_device_health: true)
  6. Magic link URL and device credentials are generated
  7. Organizer receives email with the magic link and access details (lock PIN, Wi-Fi voucher)

Deduplication​

Booking metadata tracks whether credentials have been requested (booking.metadata.mrd_booking_access.credentials_requested) to prevent duplicate magic link issuance.

Next Steps​