Changelog

This page tracks notable changes to the API and to this documentation site. New entries are added to the top as they ship.

2026-09-22 — Error handling, rate limits, and webhooks filled in from source

Rewrote Error Handling with the real {"code", "message"} envelope and every known error code (item_not_found, room_type_not_found, invalid_status_transition, etc.), sourced from the backend’s exception handler and services, not yet in openapi.json
Rewrote Rate Limits: confirmed 300 requests/minute per credential, shared across all endpoints, for both the Third-Party and Channel Manager APIs
Rewrote Webhooks: confirmed payload shape, the X-RestroLab-Timestamp header (previously an open question), exact retry/backoff behavior, and the 10-second delivery timeout
Channel Manager Overview now documents real request/response field shapes for all 7 PMS endpoints, sourced from the backend’s views and serializers — the generated spec itself still has no request/response schemas for these
Corrected a real inaccuracy: earlier pages implied each tenant has its own domain (YOUR-TENANT-DOMAIN). Confirmed from the backend that there’s actually one shared API host for every tenant — the tenant is resolved purely from the credential, never from the URL. Fixed across the homepage, Quickstart, Authentication, First Request, and API Overview.
Scope note: the backend also exposes a richer, owner-facing Channel Manager schema (connections, sync jobs, reconciliation, credential management) gated behind an internal JWT. That schema is intentionally not published here — this site only documents the AllowAny partner-facing surface.

New Channel Manager section: Overview, Authentication, and an interactive API Reference for the RestroLab Channel Manager — PMS Integration API (/v1/channel-manager/pms/*)
New spec file public/channel-manager/openapi.json, pulled from the backend’s /channel-manager/pms/schema/ endpoint, with its own npm run lint:openapi:channel-manager validation script
This is a separate, independent API contract from the Third-Party Integration API documented elsewhere on this site — different credentials (X-PMS-API-Key/X-PMS-API-Secret), different base path, own OpenAPI document
Flagged as early-stage: the generated spec doesn’t yet model request/response bodies or a security scheme for any operation — see the TODO markers on the new pages

This is the initial public release of this documentation portal, scoped to the RestroLab Third-Party Integration API (/v1/third-party/*).

Interactive API Reference (Scalar), generated from the real openapi.json (RestroLab Third-Party Integration API v1.0.0)
Getting Started guides: Quickstart, Authentication (owner JWT + partner X-API-Key/X-API-Secret), Your First Request
Developer guides: Pagination (unpaginated list endpoints), Error Handling, Rate Limits, Webhooks (signature verification, retries, idempotency)
Known gaps flagged for the backend team: X-API-Key/X-API-Secret not yet modeled as a formal securityScheme; error response bodies and the webhook signature’s timestamp header not yet in the spec

To add a new entry, insert a new ## section above this line with the date and a bulleted summary of what changed, for example:

## 2026-10-01

- Added `GET /v1/third-party/hotels/{room_type_id}/` endpoint
- Documented webhook payload bodies now that they're in the spec