Skip to content
Booking Engine API Docs

Overview

Booking Engine API v1

Section titled “Booking Engine API v1”

The managed, headless booking engine’s public /v1 API (docs/04-public-api.md). Every route is declared with @hono/zod-openapi — this document IS the contract the SDK (packages/sdk, API-013) and the Scalar docs site (DOC-001) are generated from.

Information

  • OpenAPI version: 3.1.0

Operations

Section titled “Operations”
POST
/v1/auth/login
POST
/v1/auth/logout
GET
/v1/auth/me
POST
/v1/auth/password-reset/confirm
POST
/v1/auth/password-reset/request
POST
/v1/auth/refresh
GET
/v1/availability
GET
/v1/bookings
POST
/v1/bookings
GET
/v1/bookings/{reservationId}
DELETE
/v1/bookings/{reservationId}
PATCH
/v1/bookings/{reservationId}
POST
/v1/bookings/{reservationId}/refunds
GET
/v1/channel-connections
POST
/v1/channel-connections
DELETE
/v1/channel-connections/{id}
GET
/v1/channel-connections/{id}/listings
POST
/v1/channel-connections/{id}/listings
GET
/v1/channel/conflicts
PATCH
/v1/channel/conflicts/{id}
GET
/v1/feeds/{token}
POST
/v1/holds
POST
/v1/holds/{reservationId}/confirm
POST
/v1/holds/{reservationId}/otp
POST
/v1/holds/{reservationId}/otp/verify
POST
/v1/holds/{reservationId}/payment-intent
GET
/v1/ping
POST
/v1/quotes
GET
/v1/resources
GET
/v1/resources/{id}
GET
/v1/resources/{id}/calendar
GET
/v1/resources/{id}/feed-tokens
POST
/v1/resources/{id}/feed-tokens
DELETE
/v1/resources/{id}/feed-tokens/{tokenId}
GET
/v1/resources/{id}/rates
PUT
/v1/resources/{id}/rates
GET
/v1/resources/{id}/restrictions
PUT
/v1/resources/{id}/restrictions
GET
/v1/webhook-endpoints
POST
/v1/webhook-endpoints
DELETE
/v1/webhook-endpoints/{id}
POST
/v1/webhooks/stripe

Authentication

Section titled “Authentication”

ApiKeyAuth

Section titled “ApiKeyAuth”

Secret (sk_live_…/sk_test_…) or publishable (pk_live_…/pk_test_…) API key, sent as Authorization: Bearer <key>. Publishable keys are hard-capped to availability:read/quote:read/hold:create and additionally enforce an Origin allowlist (docs/04-public-api.md §Authentication).

Security scheme type: http

SessionCookie

Section titled “SessionCookie”

Operator/dashboard session — an HttpOnly, Secure, SameSite=Lax JWT cookie issued by POST /v1/auth/login, rotated by POST /v1/auth/refresh (docs/02-architecture.md).

Security scheme type: apiKey

Cookie parameter name: be_session