Overview

The KYC API is a single unified REST API, with a single format, unified messages, objects, metadata data, headers, error handling, etc. This is a read-write API that can both retrieve existing information, such as for guests or reservations, and create or update data, such as add guest preferences or creating requests. The API is new and designed to be best-practice in respects for modern REST APIs, including OpenAPI specs, JSON schemas, excellent documentation, strict security, etc.

​

Client Libraries

There are currently no specific or special libraries needed to interact with the KYC API. You can use any library or tooling appropriate for your language. You can also use common tools like Postman and the cURL command line HTTP tool for testing, use in scripts, etc. Note that a user-agent string is required to access the API - please do not spoof or adjust this, as it helps us keep track of what clients are calling the API.

​

OpenAPI Specification

The REST API itself is documented via a full and comprehensive OpenAPI specification, in YAML, and a JSON Schema for both the request and response JSON bodies. All requests and responses must follow both the OpenAPI specs and Schema or they will be rejected. In particular, note the specs and schema both describe data type, data ranges, and validation rules for each data field - this is automatically and rigorously enforced, so be sure your client is providing valid values at all times. Please always refer to the specification and schema when writing your clients. You can also load them into tools like Swagger or Postman to test and develop against the APIs. Further, when possible, we suggest you use automated JSON Schema validators for your requests and the replies. Some clients let you load and enforce the schema on your send, which we highly recommend. Note the API is under active development, so be sure to always have the latest OpenAPI spec and schema files.

​

JSON Schema

All request and response objects must follow the KYC JSON API Schema, which is automatically enforced for both requests and responses. This includes data types and validation. Any failures will result in clear and appropriate error messaging, including on a per-field basis for field-level errors.

​

Authentication

API authentication is currently via API Key, a long-lived credential that must be provided in a header with every request. See below.