API v2 · Getting started
One header, six scopes.
Every call except the OpenAPI document and health carries a bearer key. Keys are scoped, so a key that only searches can't book.
Keys
Live keys and test keys.
vl_live_… and vl_test_… keys hit the same catalogue and spend the same credit; test keys never create Stripe charges. Create, rotate and revoke both in the dashboard. Keep keys server-side; a key in a browser bundle is a key anyone can use.
Header
curl
curl https://api.vistalink.com/v2/amenities \
-H "Authorization: Bearer $VISTALINK_API_KEY"Scopes
A key does only what it's scoped for.
Calling an endpoint without its scope returns 403 forbidden. Jobs, webhooks and the catalog helpers work with any key; GET /v2/openapi.json and GET /v2/health need none.
| Scope | Covers | Endpoints |
|---|---|---|
search | Resolve and search | POST /v2/hotels/resolvePOST /v2/search |
content | Hotel detail | GET /v2/hotels/{hotel_id} |
rates | Rates, single and batch | POST /v2/ratesPOST /v2/rates/batch |
reconcile | Room reconciliation | POST /v2/rooms/reconcile |
booking | Bookings | POST /v2/bookingsGET /v2/bookings/{booking_id}POST /v2/bookings/{booking_id}/cancel |
chat | Chat | POST /v2/chat |
Idempotency
Retry without doubling up.
Send Idempotency-Keyon any POST that starts a job or a booking; it's required on bookings. The same key with the same body returns the original response. The same key with a different body is a 409 conflict.