Every endpoint of the Hotelumo REST API, generated from the API itself.
All endpoints are relative to https://api.hotelumo.com. Create an API key in your Hotelumo dashboard, then authenticate every request with it.
apiKey — HTTP Basic auth carrying only the API key secret: Authorization: Basic base64(<key secret>).
accessToken — Operator session token issued by the Hotelumo dashboard: Authorization: Token base64(<access token>).
Download the OpenAPI specification for use with your own tooling.
Find public room offers for a stay
Returns sanitized room-type offers for the requested dates and occupancy. Prices and inventory are calculated by the server.
| Name | In | Type | Description |
|---|---|---|---|
| hotelIdrequired | path | string | |
| checkInDaterequired | query | string | |
| checkOutDaterequired | query | string | |
| adults | query | integer | |
| children | query | integer | |
| infants | query | integer |
| Status | Meaning |
|---|---|
| 200 | Public room offers |
| 400 | Invalid dates or occupancy |
| 404 | Hotel not found |
Request a room reservation
Revalidates the selected offer, then creates a REQUESTED reservation with one unassigned PENDING room for hotel staff to approve.
| Status | Meaning |
|---|---|
| 201 | Reservation request created |
| 409 | The selected offer is no longer available |
List daily rates
Reads per-day prices/inventory for a rate plan over a date window (the ARI surface). Pass hotelId, ratePlanId, dateFrom and dateTo. Requires the rates:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| hotelIdrequired | query | string | |
| ratePlanIdrequired | query | string | |
| dateFromrequired | query | string | |
| dateTorequired | query | string |
| Status | Meaning |
|---|---|
| 200 | Array of daily rates |
| 403 | API key is missing the rates:read scope |
Upsert daily rates
Batch-upserts per-day prices/inventory (max 500 per call). Requires the rates:write scope.
| Status | Meaning |
|---|---|
| 200 | The upserted daily rates |
| 403 | API key is missing the rates:write scope |
List guests
Lists the guests of your organization, optionally filtered by hotelId, email or _ids. Requires the guests:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| hotelId | query | string | |
| query | string | ||
| _ids | query | string | Comma-separated list of guest ids |
| fields | query | string | Comma-separated projection of fields to return |
| Status | Meaning |
|---|---|
| 200 | Array of guests |
| 401 | Missing or invalid credentials |
| 403 | API key is missing the guests:read scope |
| 429 | API key rate limit exceeded |
Create a guest
Requires the guests:write scope.
| Status | Meaning |
|---|---|
| 200 | The created guest |
| 403 | API key is missing the guests:write scope |
Get a guest
Returns a single guest by id. Guests belonging to another organization respond 404. Requires the guests:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| guestIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The guest |
| 404 | Not found (or owned by another organization) |
Update a guest
Updates a guest by id. Guests belonging to another organization respond 404. Requires the guests:write scope.
| Name | In | Type | Description |
|---|---|---|---|
| guestIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The updated guest |
| 404 | Not found (or owned by another organization) |
Delete a guest
Deletes a guest by id. Guests belonging to another organization respond 404. Requires the guests:write scope.
| Name | In | Type | Description |
|---|---|---|---|
| guestIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The deleted guest |
| 404 | Not found (or owned by another organization) |
List rate plans
Lists the rate plans for a hotel (pass hotelId). Rate plans are part of the ARI pricing surface, so this requires the rates:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| hotelIdrequired | query | string | |
| roomTypeId | query | string |
| Status | Meaning |
|---|---|
| 200 | Array of rate plans |
| 403 | API key is missing the rates:read scope |
Create or update a rate plan
Requires the rates:write scope.
| Status | Meaning |
|---|---|
| 200 | The created rate plan |
| 403 | API key is missing the rates:write scope |
List reservations
Lists the reservations of your organization. Optionally filter by hotelId, guestId, a legacy startTime/endTime window, or an overlapping stay window with stayDateFrom/stayDateTo. Requires the reservations:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| hotelId | query | string | |
| guestId | query | string | |
| startTime | query | string | |
| endTime | query | string | |
| stayDateFrom | query | string | Include stays checking out after this date |
| stayDateTo | query | string | Include stays checking in on or before this date |
| limit | query | integer | |
| skip | query | integer | |
| sortField | query | string | |
| sortDirection | query | string (ASC | DESC) | |
| fields | query | string | Comma-separated projection of fields to return |
| Status | Meaning |
|---|---|
| 200 | Array of reservations |
| 401 | Missing or invalid credentials |
| 403 | API key is missing the reservations:read scope |
| 429 | API key rate limit exceeded |
Create a reservation
Creates a reservation (and its ReservationRooms from the rooms array). Requires the reservations:write scope.
| Status | Meaning |
|---|---|
| 200 | The created reservation |
| 403 | API key is missing the reservations:write scope |
Get a reservation
Returns a single reservation by id, with its rooms. Reservations belonging to another organization respond 404. Requires the reservations:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| reservationIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The reservation |
| 404 | Not found (or owned by another organization) |
Update a reservation
Updates a reservation by id. Reservations belonging to another organization respond 404. Requires the reservations:write scope.
| Name | In | Type | Description |
|---|---|---|---|
| reservationIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The updated reservation |
| 403 | API key is missing the reservations:write scope |
| 404 | Not found (or owned by another organization) |
Delete a reservation
Deletes a reservation by id (cascading its rooms, folio and charges). Reservations belonging to another organization respond 404. Requires the reservations:write scope.
| Name | In | Type | Description |
|---|---|---|---|
| reservationIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The deleted reservation |
| 404 | Not found (or owned by another organization) |
Approve a requested reservation
Rechecks inventory, promotes the parent to CONFIRMED and each PENDING room to CONFIRMED, then starts the normal folio/reminder workflow. Requires the reservations:write scope.
| Status | Meaning |
|---|---|
| 200 | Approved reservation |
| 409 | The request cannot be approved or inventory changed |
List rooms
Lists the physical rooms of your organization, optionally filtered by hotelId or roomTypeId. Requires the rooms:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| hotelId | query | string | |
| roomTypeId | query | string |
| Status | Meaning |
|---|---|
| 200 | Array of rooms |
| 403 | API key is missing the rooms:read scope |
| 429 | API key rate limit exceeded |
Create a room
Requires the rooms:write scope.
| Status | Meaning |
|---|---|
| 200 | The created room |
| 403 | API key is missing the rooms:write scope |
List room types
Lists the room types of your organization, optionally filtered by hotelId. Room types are part of the physical inventory, so this requires the rooms:read scope.
| Name | In | Type | Description |
|---|---|---|---|
| hotelId | query | string |
| Status | Meaning |
|---|---|
| 200 | Array of room types |
| 403 | API key is missing the rooms:read scope |
Create a room type
Requires the rooms:write scope.
| Status | Meaning |
|---|---|
| 200 | The created room type |
| 403 | API key is missing the rooms:write scope |
List webhook subscriptions
Webhook subscriptions deliver reservation.created, reservation.updated, reservation.deleted, guest.created, guest.updated and guest.deleted events to your server as signed POST requests (X-Hotelumo-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.
| Status | Meaning |
|---|---|
| 200 | Array of webhook subscriptions (without secrets) |
Create a webhook subscription
The response includes the signing secret exactly once — store it; it cannot be retrieved again.
| Field | Type | Description |
|---|---|---|
| hotelIdrequired | string | |
| urlrequired | string | |
| events | array (reservation.created | reservation.updated | reservation.deleted | guest.created | guest.updated | guest.deleted) | Empty array subscribes to all events |
| Status | Meaning |
|---|---|
| 200 | The created subscription, including its secret |
Update a webhook subscription
url, events and active are editable; the secret and hotel are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.
| Name | In | Type | Description |
|---|---|---|---|
| webhookSubscriptionIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | The updated subscription (without secret) |
Delete a webhook subscription
| Name | In | Type | Description |
|---|---|---|---|
| webhookSubscriptionIdrequired | path | string |
| Status | Meaning |
|---|---|
| 200 | Deleted |