Guests

Scope read:guests. This scope carries personal data, so it is never pre-selected when a key is created — the agency ticks it deliberately, and the portal marks keys that hold it.

What is never returned

Identity documents captured at check-in — passport numbers, issue and expiry dates, the scanned identity name — are encrypted per booking and deleted on a retention schedule. They are not available through this API, in any form, and cannot be written through it either. A copy handed out here would outlive the deletion somewhere nobody can reach, which is the one thing the encryption exists to prevent.

What you get is ordinary master data: who the guest is and how to reach them.

GET /partner/v1/guests

Query parameter	Required	Meaning
search	no	Applied from 2 characters; matches first name, last name, e-mail or phone
page	no	1-based page number, default 1
pageSize	no	1–200, default 100; newest first

{
  "guests": [
    {
      "id": "0191b…",
      "firstName": "Nadia",
      "lastName": "Rahman",
      "email": "nadia@example.com",
      "phone": "+971 50 123 4567",
      "nationality": "AE",
      "createdAt": "2026-08-15T10:48:52.752Z"
    }
  ],
  "page": 1,
  "pageSize": 100,
  "totalItems": 312,
  "pageCount": 4
}

GET /partner/v1/guests/:id

The same record plus that guest’s stays — references, not details:

{
  "guest": {
    "id": "0191b…",
    "firstName": "Nadia",
    "lastName": "Rahman",
    "email": "nadia@example.com",
    "phone": "+971 50 123 4567",
    "nationality": "AE",
    "createdAt": "2026-08-15T10:48:52.752Z",
    "stays": [
      {
        "id": "0191a…",
        "unitSlug": "marina-loft-2br",
        "arrival": "2026-09-10",
        "departure": "2026-09-14",
        "status": "confirmed"
      }
    ]
  }
}

stays is capped at the 100 most recent. Each entry’s id works with GET /bookings/:id.

404 NOT_FOUND for an unknown id or a guest of another agency.

Handling it

You are processing someone else’s guests’ personal data. Store the minimum your integration actually needs, honour deletion requests by deleting your copy too, and remember that the agency — not you — answers to the guest for it.