Overview

Try it in the browser

The interactive API explorer renders every endpoint from the machine-readable contract and can send real requests with your own key. The contract itself is at /partner/v1/openapi.json (OpenAPI 3.1, no key needed to read it) — point your client generator at it.

This is the agency door — the key an agency creates in its own console, seeing the whole agency. Landlords and cleaning companies have their own doors with their own references: Landlord API, Cleaning API.

Base URL	https://api.myrentalcalendar.com
OpenAPI	GET /partner/v1/openapi.json — generated from the code that serves the API
Version prefix	/partner/v1 — additive changes only; breaking changes ship as /partner/v2
Auth	Authorization: Bearer hr_live_… (details)
Content type	application/json (UTF-8) both ways
Rate limit	60 requests/minute per key, shared with MCP; 429 + Retry-After beyond
Monthly quota	50,000 requests per agency per calendar month (UTC), all doors together

Endpoints

Method & path	Scope	Purpose
GET /partner/v1/me	—	The agency behind the key, its door, scopes and budget
GET /partner/v1/units	read:units	List all units
GET /partner/v1/units/:slug	read:units	One unit with amenities, photos, sleeping arrangement
GET /partner/v1/amenities	read:units	The amenity catalogue
GET /partner/v1/availability	read:availability	Blocked nights of a unit in a range
POST /partner/v1/quote	read:rates	Price a stay with the live engine
GET /partner/v1/rates	read:rates	Nightly rate calendar of a unit
GET /partner/v1/promotions	read:rates	Running promotions
GET /partner/v1/fee-types	read:rates	The agency’s active fee catalogue
GET /partner/v1/bookings	read:bookings	Booking rows without guest data
GET /partner/v1/bookings/:id	read:bookings	One booking
POST /partner/v1/bookings	write:bookings	Create a booking
POST /partner/v1/bookings/:id/cancel	write:bookings	Cancel a booking
GET /partner/v1/guests	read:guests	Guest master data and prospects
GET /partner/v1/guests/:id	read:guests	One guest with their stays
GET /partner/v1/requests	read:requests	Enquiries from the website and lead portals
GET /partner/v1/requests/:id	read:requests	One enquiry
GET /partner/v1/tasks	read:tasks	The office to-do list
GET /partner/v1/tasks/:id	read:tasks	One task
POST /partner/v1/tasks	write:tasks	Create a task
PATCH /partner/v1/tasks/:id	write:tasks	Update a task
GET /partner/v1/invoices	read:finance	Issued invoices
GET /partner/v1/invoices/:id	read:finance	One invoice with its lines
GET /partner/v1/payments	read:finance	Recorded payments
GET /partner/v1/deposits	read:finance	Security-deposit ledger
GET /partner/v1/housekeeping/jobs	read:housekeeping	Derived cleaning jobs
GET /partner/v1/housekeeping/teams	read:housekeeping	Cleaning crews
GET /partner/v1/landlords	read:landlords	Landlords with their tenures
GET /partner/v1/landlords/:id	read:landlords	One landlord
GET /partner/v1/landlords/:id/statement	read:landlords	A landlord’s statement for a period
GET /partner/v1/unit-costs	read:costs	Running cost rows
GET /partner/v1/cost-categories	read:costs	Cost category catalogue

Conventions

• Dates are ISO YYYY-MM-DD. Stays are half-open ranges [arrival, departure); a night is the date the guest sleeps.
• Amounts are integers in the agency currency’s minor unit (45000 = AED 450.00). The currency appears wherever amounts do.
• Identifiers: units are addressed by their stable slug; everything else by opaque id. Slugs come from GET /units.
• Errors always carry a stable code and a human-readable title — branch on the code, log the title. Full list: errors & limits.
• Lists paginate with ?page=1&pageSize=100 (max 200). The collection keeps its own name in the response (bookings, guests, tasks, …) and the page facts sit beside it: page, pageSize, totalItems, pageCount.
• Personal data travels only with read:guests: guest records themselves, the contact block on enquiries, the buyer block on invoices. Every other endpoint is free of it whatever the key holds.
• Budgets are announced on every answer via X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (unix seconds). Pace against the remaining count rather than waiting to be refused.
• CORS is open on this surface (Access-Control-Allow-Origin: *): it takes no cookies, so a browser can call it directly. That does not make it safe to ship a key to browsers — anyone reading your page would hold your agency’s key.