The Kabora Partner API

Your tools, especially dynamic pricing, can read your listings and calendar through this small read-and-write API and push rates back.

API Keys

Create a key under Settings → API access. Each key belongs to one business, reads every listing in it, carries only the scopes you grant, and can be revoked without affecting anything else. Send it on every request:

• Authorization: Bearer <key>

Versions

Every answer carries version, which today is 2026-09-24: the day the shape last changed in a way an existing caller would read incorrectly. Pin to it.

The version moves if a field is removed, renamed or changes its meaning. A new field does not move it, so read the fields you know and ignore the rest.

Listings

GET /api/partner/v1/properties

Returns every listing, in data, with its location, capacity, amenities and base rate, enough for a pricing tool to map its own records onto yours. Each listing:

• id — The listing's id; the calendar endpoint takes it.
• name — What the host calls the listing.
• status — listed, draft or unlisted.
• address.line1 — Street address.
• address.city — City.
• address.state — State, province or region, as the host typed it.
• address.postal_code — Postal code.
• address.country — Two-letter country code.
• address.latitude — Latitude, or null.
• address.longitude — Longitude, or null.
• timezone — The listing's time zone, an IANA name.
• currency — The currency every _cents amount of this listing is in.
• capacity.max_guests — Most guests it sleeps.
• capacity.bedrooms — Bedrooms.
• capacity.beds — Beds.
• capacity.bathrooms — Full bathrooms.
• capacity.half_bathrooms — Half bathrooms, counted apart from the full ones.
• amenities — Amenity keys.
• base_price_cents — The nightly rate before any night's own price.
• min_nights — Shortest stay.
• max_nights — Longest stay, or null for none.

Money

Every amount is a whole number of hundredths of the listing's own currency, which each listing carries as currency. This holds whatever that currency does with decimals. A $150.00 night is 15000 beside USD. A ¥15,000 night is 1500000 beside JPY, although the yen has no smaller coin.

The fields end in _cents for every currency, and price_cents in a push is read the same way. The public feed, which needs no key, gives the same prices in whole units.

Calendar

GET /api/partner/v1/properties/:id/calendar?start=&end=

Returns each night, in data, with price, minimum stay and availability. Each night:

• date — The night, YYYY-MM-DD.
• price_cents — What the night sells for.
• min_nights — Shortest stay that may start this night.
• available — Whether the night can be booked.
• status — open, reserved (a stay holds it), blocked (a block holds it) or closed (closed by hand).

POST /api/partner/v1/properties/:id/calendar

Pushes rates back, as { days: [{ date, price_cents, min_nights, available }] }.

A night you priced by hand is never overwritten. Those dates come back in skipped_host_priced_dates, so the tool can show what it left alone. A wedding weekend you set to four hundred stays four hundred.

The answer:

• updated — How many of the nights you sent were written.
• skipped_host_priced_dates — Nights the host priced by hand, left as they are.

Reservations

GET /api/partner/v1/reservations?since=

Returns stays with their full financial breakdown, 500 at a time, with has_more if there are more. since returns stays checking out on or after that date.

Guest data is limited to a first name, to protect guest privacy: a pricing tool needs what a stay earned, not who stayed. Each stay:

• id — The stay's id.
• code — The confirmation code the guest and host read.
• property_id — The listing it is at.
• status — The stay's status, a word from the reservation statuses article.
• source — Where the stay came from: kabora, direct (the host's own site), manual (typed in by the host), ical (a calendar link), or the site it was imported from — airbnb, vrbo, booking_com, furnished_finder, zillow, ale.
• check_in — First night, YYYY-MM-DD.
• check_out — The morning they leave, YYYY-MM-DD — not a night of the stay.
• nights — Nights stayed.
• guests — Adults and children; infants are not counted.
• guest_first_name — The guest's first name, and nothing else about them.
• currency — The currency of every amount below.
• financials.accommodation_cents — The nights, before fees.
• financials.cleaning_fee_cents — The cleaning fee.
• financials.extra_guest_fee_cents — The charge for guests past those the rate includes.
• financials.taxes_cents — Taxes.
• financials.platform_fee_cents — A fee once charged to the GUEST on top of the price. Retired: it is 0 on every booking since 2026-08-14. It is not Kabora's commission, which is kabora_commission_cents.
• financials.kabora_commission_cents — Kabora's commission on the stay. It comes out of the host's side, never the guest's, and host_payout_cents is already after it. 0 on a stay whose money did not go through Kabora.
• financials.host_payout_cents — The host's share of the stay as priced, after Kabora's commission. A cancellation does not change it: what was refunded, and what the host kept, is in the stay's payments.
• financials.total_cents — What the guest pays.

Webhooks

The API answers when your tool asks. A webhook works the other way: Kabora tells your tool when something happens to a stay, so it does not have to keep asking.

Add an address under Settings → API access → Webhooks. Only an admin who looks after every listing can add one, because it is told about every stay in the business. It must be a public https address with no name or password in it, and a business keeps at most 5. Choose what each is told:

• reservation.created: A stay is booked.
• reservation.changed: A stay's dates, guests, total, space or status change.
• reservation.cancelled: A stay is canceled.
• payment.received: A payment for a stay arrives.
• payment.refunded: Money for a stay is refunded.

Adding an address shows its signing secret once. Copy it and keep it with your tool, because it is never shown again.

What a Webhook Sends

Each message is a POST of JSON:

• id: The event.
• type: One of the five above.
• created_at: When it happened.
• api_version: The version under "Versions" above.
• data.reservation: The stay, with the same fields as the reservations list above.
• data.money: On the two payment events only: currency, paid_cents and refunded_cents, as they stand when the message is sent.

It carries three headers:

• Kabora-Signature: t=<seconds>,v1=<signature>.
• Kabora-Event: The same value as type.
• Kabora-Delivery: This message's id, the same on every try. Use it to ignore a message you have already handled.

Checking the Signature

Compute the HMAC-SHA256 of <t>.<body>, using your signing secret and the body exactly as received, and compare its hex with v1. Refuse a message that does not match. Kabora's own check also refuses a t more than 5 minutes from the current time, and yours should too.

When a Message Is Sent

A payment, a cancellation or an accepted change is sent within seconds, and anything else within the hour.

Answer with any 2xx status to confirm you received it. Kabora tries a message again over the following hours when your address gives another answer or none. After 8 failures in a row the address is paused, and nothing is sent until you press Resume, which sends again what it missed. Latest messages on the same page lists what was sent and what your address answered.