Operate

Changelog

Additive changes never bump the version; a breaking change ships as a new version alongside the old one.

Bookings, scoped keys, address allowlists, this site 20 Oct 2026

POST /bookings, GET /bookings, GET /bookings/{bookingId}, POST /bookings/{bookingId}/cancel for hotels that run the ZimmerStack PMS and their own booking engine.
Keys carry scopes (ari:read, ari:write, bookings:read, bookings:write, bookings:payments). Keys minted before today hold the two ari scopes and keep working unchanged.
Optional per-key address allowlist (IPv4/IPv6 CIDRs); 403 IP_NOT_ALLOWED outside it.
New codes: SCOPE_MISSING, IP_NOT_ALLOWED, PROPERTY_UNAVAILABLE (deleted or demo property — previously reported as CHANNEL_MANAGER_DISABLED), PMS_NOT_AVAILABLE, the booking codes.
GET /property now echoes scopes, products and bookingsPerMinute.
Three booking budgets: bookings, property-bookings (per minute) and property-bookings-day (a rolling day).
Postman folder 5 · Bookings.

Bearer keys per property; GET /property, /catalog, /availability, /rates, /restrictions, /sync, /batches/{batchId}; PUT /availability, /rates, /restrictions.
Public OpenAPI 3.1 contract and Postman collection generated from the validating schemas.
Inbound budgets with RateLimit headers; idempotency via x-idempotency-key.

channel.booking.created / modified / cancelled with Standard Webhooks signing, replay and recovery; apiVersion 2026-09-01.