Skip to content

Overview

Base URLhttps://api.myrentalcalendar.com
OpenAPIGET /partner/v1/openapi.json — generated from the code that serves the API
Version prefix/partner/v1 — additive changes only; breaking changes ship as /partner/v2
AuthAuthorization: Bearer hr_live_… (details)
Content typeapplication/json (UTF-8) both ways
Rate limit60 requests/minute per key, shared with MCP; 429 + Retry-After beyond
Monthly quota50,000 requests per agency per calendar month (UTC)
Method & pathScopePurpose
GET /partner/v1/meThe agency behind the key, its scopes and rate budget
GET /partner/v1/unitsread:unitsList all units
GET /partner/v1/units/:slugread:unitsOne unit in full detail
GET /partner/v1/availabilityread:availabilityBlocked nights of a unit in a range
POST /partner/v1/quoteread:ratesPrice a stay with the live engine
GET /partner/v1/fee-typesread:ratesThe agency’s active fee catalogue
GET /partner/v1/bookingsread:bookingsBooking rows without guest data
GET /partner/v1/bookings/:idread:bookingsOne booking
POST /partner/v1/bookingswrite:bookingsCreate a booking
POST /partner/v1/bookings/:id/cancelwrite:bookingsCancel a booking
GET /partner/v1/guestsread:guestsGuest master data
GET /partner/v1/guests/:idread:guestsOne guest with their stays
  • Dates are ISO YYYY-MM-DD. Stays are half-open ranges [arrival, departure); a night is the date the guest sleeps.
  • Amounts are integers in the agency currency’s minor unit (45000 = AED 450.00). The currency appears wherever amounts do.
  • Identifiers: units are addressed by their stable slug; bookings by opaque id. Slugs come from GET /units.
  • Errors always carry a stable code and a human-readable title — branch on the code, log the title. Full list: errors & limits.
  • Lists paginate with ?page=1&pageSize=100 (max 200). The collection keeps its own name in the response (bookings, guests) and the page facts sit beside it: page, pageSize, totalItems, pageCount.
  • Budgets are announced on every answer via X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (unix seconds). Pace against the remaining count rather than waiting to be refused.
  • CORS is open on this surface (Access-Control-Allow-Origin: *): it takes no cookies, so a browser can call it directly. That does not make it safe to ship a key to browsers — anyone reading your page would hold your agency’s key.