---
title: "BookingCreate"
method: POST
path: "/BookingCreate"
tags: ["Callbacks"]
---

# BookingCreate

`POST /BookingCreate`

**Endpoint:** `https://api.myallocator.com/callback/ota/{ota}/v202203` (replace `{ota}` with your channel ID)

Use this callback to send us new bookings. Using this callback ensures that
there is no delay between the creation of the booking and import on
Cloudbeds. Therefore it's strongly recommend to implement this callback.
Even when implemented it's still necessary to also implement the
`GetBookingList` and `GetBookingId` calls, which act as fallbacks if
the `CreateBooking` notification fails, when a reimport due to processing
issues on Cloudbeds is necessary, or when a specific booking needs to be
debugged.

The booking format is identical to what is being returned in the
`GetBookingId` call. The booking format is described
[here in full detail](https://github.com/MyAllocator/build2us-apidocs/blob/gh-pages/booking_format_b2u.md).

See the documentation about `GetBookingId` for more details on the format.
The specification listed here is not complete and just the minimal
requirement.

The request body is a JSON object (`Content-Type: application/json`)
carrying `mya_property_id` (or `ota_property_id`), `shared_secret` and
`booking_json`, with `booking_json` embedded directly as a JSON object.
Existing integrations submitting `application/x-www-form-urlencoded`
form fields continue to work.

## Sending credit/debit card data

Guest credit/debit card data (the booking's `Payments` object) is **not
accepted at the standard `BookingCreate` endpoint shown above.** Bookings
that contain card data must be sent to a dedicated, PCI-compliant endpoint
that Cloudbeds provides specifically for your channel.

To send card data, your channel must be enabled for card handling:

* **Provide a PCI Attestation of Compliance (AoC)** document to Cloudbeds.
  Card data cannot be enabled for a channel until the AoC has been received
  and approved.
* Cloudbeds **configures your channel for card handling** and provides you
  with the dedicated secure URL to use in place of the standard
  `BookingCreate` endpoint, along with the credentials described below.
* **Authenticate** every request to the secure URL either with the
  `tx-proxy-key` header (a secret key that Cloudbeds issues to your channel),
  or from a set of source IP addresses that you supply to Cloudbeds for
  allow-listing.

The request format is identical to the standard endpoint: post the same JSON
booking, including the `Payments` object with the card details. Bookings that
do not contain card data are sent to the standard endpoint.

Within the `Payments` object, `CardNumber` and `SeriesCode` **must be encoded
as JSON strings** (quoted values, e.g. `"SeriesCode": "143"`), never as bare
JSON numbers. The secure endpoint tokenizes these values in place with
non-numeric tokens; unquoted numeric values cannot be tokenized.

Requests to the secure endpoint must use `application/json`.
`multipart/form-data` is **not supported on the secure endpoint**.

A booking that contains card data is **rejected with an error and not
imported** unless your channel has been enabled for card handling. In that
case the response has `Success: false` and `ErrorCode` `1032`.

## Headers

- `tx-proxy-key` string

## Request body

- object
  - `mya_property_id` integer — Property ID on the Cloudbeds channel manager
  - `ota_property_id` string — Username, login or property ID on the OTA
  - `ota_property_sub_id` string — Property ID on the OTA, if OTA supports multiple properties under one `ota_property_id`/`ota_property_password` combination. See `GetSubProperties` for more details.
  - `shared_secret` string, required — Authentication between the OTA and the channel. Identical for all requests. Not to be shared with customers.
  - `booking_json` union, required — The booking payload, embedded directly as a JSON object (recommended) or as a JSON-encoded string. See the response for `GetBookingId` for a minimal example and check the "Booking Format" section of this documentation.
    - object
    - string

## Response `200`

BookingCreate

- union
  - object — No returned error means the booking has been enqueued into Cloudbeds for import.
    - `Success` true, required — Always `true` on success.
  - ResponseCallbackError
    - `Success` false, required — Always `false` when the response contains an error.
    - `ErrorCode` integer, required — Error code. Check the "Error Codes" section of the specification for valid codes.
    - `Error` string, required — Human-readable error message.

---

[API](https://skmtc.net/cloudbeds/apis/cloudbeds-api.md) · [All operations](https://skmtc.net/cloudbeds/apis/cloudbeds-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cloudbeds/cloudbeds-api/revisions/2faa857793e8/schema)