BookingCreate

Endpoint: https://api.myallocator.com/callback/ota/{ota}/v202203 (replace {ota} with your channel ID)

Use this callback to send us new bookings. Using this callback ensures that there is no delay between the creation of the booking and import on Cloudbeds. Therefore it's strongly recommend to implement this callback. Even when implemented it's still necessary to also implement the GetBookingList and GetBookingId calls, which act as fallbacks if the CreateBooking notification fails, when a reimport due to processing issues on Cloudbeds is necessary, or when a specific booking needs to be debugged.

The booking format is identical to what is being returned in the GetBookingId call. The booking format is described here in full detail.

See the documentation about GetBookingId for more details on the format. The specification listed here is not complete and just the minimal requirement.

The request body is a JSON object (Content-Type: application/json) carrying mya_property_id (or ota_property_id), shared_secret and booking_json, with booking_json embedded directly as a JSON object. Existing integrations submitting application/x-www-form-urlencoded form fields continue to work.

Sending credit/debit card data

Guest credit/debit card data (the booking's Payments object) is not accepted at the standard BookingCreate endpoint shown above. Bookings that contain card data must be sent to a dedicated, PCI-compliant endpoint that Cloudbeds provides specifically for your channel.

To send card data, your channel must be enabled for card handling:

• Provide a PCI Attestation of Compliance (AoC) document to Cloudbeds. Card data cannot be enabled for a channel until the AoC has been received and approved.
• Cloudbeds configures your channel for card handling and provides you with the dedicated secure URL to use in place of the standard BookingCreate endpoint, along with the credentials described below.
• Authenticate every request to the secure URL either with the tx-proxy-key header (a secret key that Cloudbeds issues to your channel), or from a set of source IP addresses that you supply to Cloudbeds for allow-listing.

The request format is identical to the standard endpoint: post the same JSON booking, including the Payments object with the card details. Bookings that do not contain card data are sent to the standard endpoint.

Within the Payments object, CardNumber and SeriesCode must be encoded as JSON strings (quoted values, e.g. "SeriesCode": "143"), never as bare JSON numbers. The secure endpoint tokenizes these values in place with non-numeric tokens; unquoted numeric values cannot be tokenized.

Requests to the secure endpoint must use application/json. multipart/form-data is not supported on the secure endpoint.

A booking that contains card data is rejected with an error and not imported unless your channel has been enabled for card handling. In that case the response has Success: false and ErrorCode 1032.