Your website. Tulo's bookings.
Show live rates and availability on your own site, and take bookings that land in the same rack as everything else. A night taken on your website is taken in the app too.
OpenAPI 1.1.0 · api.tulo.homes/partner/v1
POST /partner/v1/bookings Host: api.tulo.homes Authorization: Bearer tulo_pk_•••••••• X-Tulo-Key-Id: •••••••• X-Tulo-Timestamp: 1800000000 X-Tulo-Nonce: 3f1c9a52-… X-Tulo-Signature: •••••••••••••• Idempotency-Key: 9b2e41c0
Keys
A manager issues keys in the Tulo property dashboard. Every key belongs to one place. Keys are stored hashed; the full key is shown once.
| Type | Prefix | Where it lives | Scopes |
|---|---|---|---|
| Secret | tulo_pk_ | The website's server only | read, bookings.read, bookings.write |
| Publishable | tulo_pub_ | The visitor's browser, bound to your exact https origins | read |
Routes
Reading is unsigned. Everything under /bookings is signed by your server with an Ed25519 key you registered with Tulo, and POST /bookings needs an Idempotency-Key.
| Route | What it does | Key |
|---|---|---|
| GET /place | The place's website content | Publishable or secret |
| GET /calendar | Availability, nightly rates and stay rules per room type per night, up to 90 nights | Publishable or secret |
| GET /quote | Price a stay | Publishable or secret |
| POST /bookings | Book a stay | Secret, signed |
| GET /bookings | The website's own bookings, for reconciliation | Secret, signed |
| GET /bookings/{id} | One of the website's own bookings | Secret, signed |
| POST /bookings/{id}/cancel | Cancel one of the website's own bookings for the guest | Secret, signed |
| GET /signing-keys | Tulo's webhook signing public keys | None |
Webhooks
Tulo posts booking events to your site and signs every delivery with its own Ed25519 key. Verify it against the public keys at GET /signing-keys, which need no key to read.
For the full reference, signing strings and test vectors, write to hello@mail.tulo.homes.