TimeZest API Patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited TimeZest API Patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
TimeZest provides scheduling-request flows tightly coupled to MSP PSA systems. A scheduling request is created against a PSA ticket (ConnectWise / Autotask / Halo), TimeZest sends the customer a self-service booking link, and the technician's calendar is updated when the customer picks a slot.
TimeZest uses an API token passed via header.
| Header | Value |
|---|---|
X-Timezest-Api-Token | The raw TimeZest API token |
The gateway maps the environment variable TIMEZEST_API_TOKEN onto the X-Timezest-Api-Token header automatically. Internally, the TimeZest MCP server forwards this to TimeZest as a Bearer token — you do not need to add the Bearer prefix yourself.
export TIMEZEST_API_TOKEN="your-timezest-token"| Tool | Purpose |
|---|---|
timezest_navigate | Discover the available domains |
timezest_back | Pop back to the prior context |
timezest_status | Health/status check |
Tools follow timezest_<domain>_<action>. Domains:
agents (technicians)teamsappointment_typesresourcesscheduling (the primary domain)associated_entitiesThis is the most important pattern. When you call timezest_scheduling_create_request, the payload carries an associated_entities array that links the booking to a PSA record:
{
"associated_entities": [
{
"type": "ConnectWiseTicket",
"id": 12345
}
]
}Supported PSA types: ConnectWise tickets, Autotask tickets, Halo tickets. Always include the PSA association so the tech's PSA shows the booking.
TimeZest's MCP surface is poll-only. To track a booking's lifecycle (sent / clicked / booked / canceled), call timezest_scheduling_get on a cadence. Reasonable cadence:
Do not assume a webhook will arrive — none does at the MCP layer.
| Status | Meaning | Action |
|---|---|---|
| 401 | Bad/missing Bearer token | Re-check TIMEZEST_API_TOKEN |
| 403 | Token valid but not authorized for the agent/team | Check token scope |
| 404 | Unknown agent / team / scheduling request | Re-list to confirm |
| 422 | Bad payload (missing PSA association, invalid appointment_type) | Validate input |
associated_entities entry — a booking with noPSA association is hard to find later.
creating a request; do not hard-code IDs.
as the primary input and resolve agent/team/appointment from context.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.