Hotelumo API reference

Every endpoint of the Hotelumo REST API, generated from the API itself.

All endpoints are relative to https://api.hotelumo.com. Create an API key in your Hotelumo dashboard, then authenticate every request with it.

apiKey HTTP Basic auth carrying only the API key secret: Authorization: Basic base64(<key secret>).

accessToken Operator session token issued by the Hotelumo dashboard: Authorization: Token base64(<access token>).

Download the OpenAPI specification for use with your own tooling.

Availability

GET/api/hotels/{hotelId}/availability

Find public room offers for a stay

Returns sanitized room-type offers for the requested dates and occupancy. Prices and inventory are calculated by the server.

apiKey
Parameters
NameInTypeDescription
hotelIdrequiredpathstring
checkInDaterequiredquerystring
checkOutDaterequiredquerystring
adultsqueryinteger
childrenqueryinteger
infantsqueryinteger
Responses
StatusMeaning
200Public room offers
400Invalid dates or occupancy
404Hotel not found
POST/api/hotels/{hotelId}/book-reservation

Request a room reservation

Revalidates the selected offer, then creates a REQUESTED reservation with one unassigned PENDING room for hotel staff to approve.

apiKey
Responses
StatusMeaning
201Reservation request created
409The selected offer is no longer available

Daily rates

GET/api/dailyRates

List daily rates

Reads per-day prices/inventory for a rate plan over a date window (the ARI surface). Pass hotelId, ratePlanId, dateFrom and dateTo. Requires the rates:read scope.

rates:readapiKeyaccessToken
Parameters
NameInTypeDescription
hotelIdrequiredquerystring
ratePlanIdrequiredquerystring
dateFromrequiredquerystring
dateTorequiredquerystring
Responses
StatusMeaning
200Array of daily rates
403API key is missing the rates:read scope
POST/api/dailyRates

Upsert daily rates

Batch-upserts per-day prices/inventory (max 500 per call). Requires the rates:write scope.

rates:writeapiKeyaccessToken
Responses
StatusMeaning
200The upserted daily rates
403API key is missing the rates:write scope

Guests

GET/api/guests

List guests

Lists the guests of your organization, optionally filtered by hotelId, email or _ids. Requires the guests:read scope.

guests:readapiKeyaccessToken
Parameters
NameInTypeDescription
hotelIdquerystring
emailquerystring
_idsquerystringComma-separated list of guest ids
fieldsquerystringComma-separated projection of fields to return
Responses
StatusMeaning
200Array of guests
401Missing or invalid credentials
403API key is missing the guests:read scope
429API key rate limit exceeded
POST/api/guests

Create a guest

Requires the guests:write scope.

guests:writeapiKeyaccessToken
Responses
StatusMeaning
200The created guest
403API key is missing the guests:write scope
GET/api/guests/{guestId}

Get a guest

Returns a single guest by id. Guests belonging to another organization respond 404. Requires the guests:read scope.

guests:readapiKeyaccessToken
Parameters
NameInTypeDescription
guestIdrequiredpathstring
Responses
StatusMeaning
200The guest
404Not found (or owned by another organization)
PUT/api/guests/{guestId}

Update a guest

Updates a guest by id. Guests belonging to another organization respond 404. Requires the guests:write scope.

guests:writeapiKeyaccessToken
Parameters
NameInTypeDescription
guestIdrequiredpathstring
Responses
StatusMeaning
200The updated guest
404Not found (or owned by another organization)
DELETE/api/guests/{guestId}

Delete a guest

Deletes a guest by id. Guests belonging to another organization respond 404. Requires the guests:write scope.

guests:writeapiKeyaccessToken
Parameters
NameInTypeDescription
guestIdrequiredpathstring
Responses
StatusMeaning
200The deleted guest
404Not found (or owned by another organization)

Rate plans

GET/api/ratePlans

List rate plans

Lists the rate plans for a hotel (pass hotelId). Rate plans are part of the ARI pricing surface, so this requires the rates:read scope.

rates:readapiKeyaccessToken
Parameters
NameInTypeDescription
hotelIdrequiredquerystring
roomTypeIdquerystring
Responses
StatusMeaning
200Array of rate plans
403API key is missing the rates:read scope
POST/api/ratePlans

Create or update a rate plan

Requires the rates:write scope.

rates:writeapiKeyaccessToken
Responses
StatusMeaning
200The created rate plan
403API key is missing the rates:write scope

Reservations

GET/api/reservations

List reservations

Lists the reservations of your organization. Optionally filter by hotelId, guestId, a legacy startTime/endTime window, or an overlapping stay window with stayDateFrom/stayDateTo. Requires the reservations:read scope.

reservations:readapiKeyaccessToken
Parameters
NameInTypeDescription
hotelIdquerystring
guestIdquerystring
startTimequerystring
endTimequerystring
stayDateFromquerystringInclude stays checking out after this date
stayDateToquerystringInclude stays checking in on or before this date
limitqueryinteger
skipqueryinteger
sortFieldquerystring
sortDirectionquerystring (ASC | DESC)
fieldsquerystringComma-separated projection of fields to return
Responses
StatusMeaning
200Array of reservations
401Missing or invalid credentials
403API key is missing the reservations:read scope
429API key rate limit exceeded
POST/api/reservations

Create a reservation

Creates a reservation (and its ReservationRooms from the rooms array). Requires the reservations:write scope.

reservations:writeapiKeyaccessToken
Responses
StatusMeaning
200The created reservation
403API key is missing the reservations:write scope
GET/api/reservations/{reservationId}

Get a reservation

Returns a single reservation by id, with its rooms. Reservations belonging to another organization respond 404. Requires the reservations:read scope.

reservations:readapiKeyaccessToken
Parameters
NameInTypeDescription
reservationIdrequiredpathstring
Responses
StatusMeaning
200The reservation
404Not found (or owned by another organization)
PUT/api/reservations/{reservationId}

Update a reservation

Updates a reservation by id. Reservations belonging to another organization respond 404. Requires the reservations:write scope.

reservations:writeapiKeyaccessToken
Parameters
NameInTypeDescription
reservationIdrequiredpathstring
Responses
StatusMeaning
200The updated reservation
403API key is missing the reservations:write scope
404Not found (or owned by another organization)
DELETE/api/reservations/{reservationId}

Delete a reservation

Deletes a reservation by id (cascading its rooms, folio and charges). Reservations belonging to another organization respond 404. Requires the reservations:write scope.

reservations:writeapiKeyaccessToken
Parameters
NameInTypeDescription
reservationIdrequiredpathstring
Responses
StatusMeaning
200The deleted reservation
404Not found (or owned by another organization)
POST/api/reservations/{reservationId}/approve

Approve a requested reservation

Rechecks inventory, promotes the parent to CONFIRMED and each PENDING room to CONFIRMED, then starts the normal folio/reminder workflow. Requires the reservations:write scope.

reservations:writeapiKeyaccessToken
Responses
StatusMeaning
200Approved reservation
409The request cannot be approved or inventory changed

Rooms

GET/api/rooms

List rooms

Lists the physical rooms of your organization, optionally filtered by hotelId or roomTypeId. Requires the rooms:read scope.

rooms:readapiKeyaccessToken
Parameters
NameInTypeDescription
hotelIdquerystring
roomTypeIdquerystring
Responses
StatusMeaning
200Array of rooms
403API key is missing the rooms:read scope
429API key rate limit exceeded
POST/api/rooms

Create a room

Requires the rooms:write scope.

rooms:writeapiKeyaccessToken
Responses
StatusMeaning
200The created room
403API key is missing the rooms:write scope

Room types

GET/api/roomTypes

List room types

Lists the room types of your organization, optionally filtered by hotelId. Room types are part of the physical inventory, so this requires the rooms:read scope.

rooms:readapiKeyaccessToken
Parameters
NameInTypeDescription
hotelIdquerystring
Responses
StatusMeaning
200Array of room types
403API key is missing the rooms:read scope
POST/api/roomTypes

Create a room type

Requires the rooms:write scope.

rooms:writeapiKeyaccessToken
Responses
StatusMeaning
200The created room type
403API key is missing the rooms:write scope

Webhook subscriptions

GET/api/webhooksubscriptions

List webhook subscriptions

Webhook subscriptions deliver reservation.created, reservation.updated, reservation.deleted, guest.created, guest.updated and guest.deleted events to your server as signed POST requests (X-Hotelumo-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.

accessToken
Responses
StatusMeaning
200Array of webhook subscriptions (without secrets)
POST/api/webhooksubscriptions

Create a webhook subscription

The response includes the signing secret exactly once — store it; it cannot be retrieved again.

accessToken
Request body
FieldTypeDescription
hotelIdrequiredstring
urlrequiredstring
eventsarray (reservation.created | reservation.updated | reservation.deleted | guest.created | guest.updated | guest.deleted)Empty array subscribes to all events
Responses
StatusMeaning
200The created subscription, including its secret
PUT/api/webhooksubscriptions/{webhookSubscriptionId}

Update a webhook subscription

url, events and active are editable; the secret and hotel are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.

accessToken
Parameters
NameInTypeDescription
webhookSubscriptionIdrequiredpathstring
Responses
StatusMeaning
200The updated subscription (without secret)
DELETE/api/webhooksubscriptions/{webhookSubscriptionId}

Delete a webhook subscription

accessToken
Parameters
NameInTypeDescription
webhookSubscriptionIdrequiredpathstring
Responses
StatusMeaning
200Deleted