{"activeVersionTag":"latest","latestAvailableVersionTag":"latest","collection":{"info":{"_postman_id":"836595e4-d02b-4475-8dab-08f572458ee1","name":"Zonal PMS Public Open API","description":"# Open Api\n\nHTTP gateway exposing hotel/PMS data to integrations. This collection demonstrates the public-facing endpoints and response envelopes.\n\n## Quick start\n\n1. Select an environment.\n    \n2. Run **Authentication → Login** — its test script writes `{{accessToken}}` and `{{refreshToken}}` to the active environment.\n    \n3. The collection-level bearer auth resolves `{{accessToken}}` for every other request. Re-run Login when the JWT expires (\\~15 min); use **Authentication → Refresh** to renew without re-supplying credentials.\n    \n\n## Environments\n\n| Name | Base URL |\n| --- | --- |\n| Staging (integrate & test here first) | `https://api.stage.dev.high-level-software.com/api/v1/` |\n| Production | `https://api.high-level-software.com/api/v1/` |\n\n`{{url}}`, `{{apiKey}}`, `{{clientToken}}` and `{{clientSecret}}` are blank placeholders in both saved environments — populate them per environment before use. StartFragmentAll paths in this guide are relative to the base URL.\n\n**Build and test against Staging first** — it lets you validate your retry, pagination and delta logic without affecting live operations.\n\n## Variables\n\n| Name | Type | Example | Purpose |\n| --- | --- | --- | --- |\n| `{{url}}` | env | `https://api.stage.dev.high-level-software.com/api/v1` | Base URL — swap per environment |\n| `{{apiKey}}` | env (secret) | (empty locally) | AWS API Gateway usage-plan key, sent as `X-API-Key` — guards against throttling only, not an app credential |\n| `{{clientToken}}` | env | `your-client-token` | Static per-hotel integration credential (`client_credentials` grant), issued by ZHS staff — sent in the Login body |\n| `{{clientSecret}}` | env (secret) | `secret` | Paired secret for `{{clientToken}}` — sent in the Login body |\n| `{{accessToken}}` | env (secret) | (set by Login) | Short-lived (\\~15 min) bearer JWT written by Login/Refresh; resolves the collection-level bearer auth |\n| `{{refreshToken}}` | env (secret) | (set by Login) | Exchanges for a new `{{accessToken}}` via Refresh, without resupplying `{{clientToken}}`/`{{clientSecret}}` |\n| `{{rateRangeFrom}}` / `{{rateRangeTo}}` | request-scoped | (set by Final Suggested's pre-request script) | Rolling 7-day window for `Rates / Final Suggested`. |\n\n## Before you integrate — five rules\n\nIf you only take five things from this guide, take these. The vast majority of integration problems we see come from one of these not being followed:\n\n1. **Implement retry logic with exponential back-off. This is expected, not optional.** A single failed request is normal under load — your client must retry transient failures, not give up.\n    \n2. **Pull** _**changes**_**, not** _**everything**_**.** After your first load, use the `updated` filter to fetch only what changed since you last ran. Don't re-download the full dataset every time.\n    \n3. **Keep each request small and fast.** Narrow date windows and sensible page sizes. Requests that run too long are cut off by the gateway (\\~30s) and return a `504`.\n    \n4. **Don't hammer us in parallel.** Page through results sequentially (or with very low concurrency). Flooding the API with simultaneous requests slows everyone down — including you.\n    \n5. **Authenticate once and reuse your token.** Log in, cache the access token, and reuse it until it expires. Don't log in on every request.\n    \n\n## What this API is for\n\nThe High Level Open API is a friendly, intuitive interface over the HLS PMS. Partners typically use it to:\n\n- **Ingest reservation, sales and availability data** into a data warehouse or BI platform (e.g. for analytics/reporting).\n    \n- **Read hotel, rate and block configuration.**\n    \n- **Drive operational actions** such as check-in / check-out and rate updates.\n    \n\nIt is a **JSON over HTTPS** API. Most read operations are `POST .../search` calls that take a JSON filter body (this lets you express rich queries that wouldn't fit in a URL).\n\n## Tiers\n\nThere are different tiers to subscribe to, reach out to support or sales to understand more about them.\n\n- Small Quota\n    \n- Medium Quota\n    \n- Large Quota\n    \n\n## Conventions\n\n- **Response envelope:** `{ data, messages, meta }`. `data` carries the resource. `messages` is keyed by severity (`debug` / `info` / `success` / `notice` / `validation` / `warning` / `error` / `critical` / `alert` / `emergency`) — error responses use `messages.warning[]` or `messages.error[]` with `{ message, context }` entries. `meta` carries `statusCode`, `reasonPhrase`, and response `headers`.\n    \n- **Timestamps** are ISO 8601 UTC.\n    \n- **Money** is in minor units (e.g. pence).\n    \n- **Pagination:** page-based via `?page=` (1-based). Iterate using `meta.pagination.has_more_pages` / `next_page_url` — don't hard-code a page count or rely on `total` / `last_page`. `per_page` is server-controlled; read it from the response rather than assuming a fixed size.\n    \n- **UUIDs** are RFC 4122 v1/v4 lowercase, used both for path params and as filter values.\n    \n\n## Endpoints\n\n- **Authentication** – User login and token refresh.\n    \n- **Blocks** – Read a block by UUID; search across blocks.\n    \n- **Hotels** – Hotel search.\n    \n- **Rates** – Rate configuration, bulk rate updates, final suggested rates.\n    \n- **Reservations** – Full lifecycle: search, read, check-in, check-out.\n    \n- **Reports** – Daily sales summaries and card-issue reporting.\n    \n- **Availability** – Inventory availability search.\n    \n- **Health** – Service liveness probe.\n    \n\n## Searching & filtering\n\nSearch endpoints take a JSON body where **each key is a field and each value is a filter object** with a `type`. Multiple filters are combined with **AND**. Omit a filter to leave that field unconstrained.\n\n### Filter types\n\n| `type` | Shape | Meaning |\n| --- | --- | --- |\n| `in` | `{ \"type\": \"in\", \"values\": [\"uuid1\",\"uuid2\"] }` | Field is one of the listed values |\n| `equal` | `{ \"type\": \"equal\", \"value\": \"active\" }` | Field equals value |\n| `between` | `{ \"type\": \"between\", \"from\": \"2026-05-01\", \"to\": \"2026-05-31\" }` | Date in range (inclusive) |\n| `before` | `{ \"type\": \"before\", \"value\": \"2026-05-01\" }` | Before a value/date |\n| `after` | `{ \"type\": \"after\", \"value\": \"2026-05-01\" }` | After a value/date |\n| `today` | `{ \"type\": \"today\" }` | Equals today |\n| `bool` | `{ \"type\": \"bool\", \"value\": \"true\" }` | Boolean flag |\n\n## Pagination\n\nList responses are paginated. Control the page with the `page` query parameter (1-based):\n\n`POST /reservations/search?page=2`\n\nThe page details come back in `meta.pagination`:\n\n`\"pagination\": { \"current_page\": 1, \"per_page\": 15, \"from\": 0, \"to\": 15, \"total\": 18, \"last_page\": 2, \"has_more_pages\": true, \"next_page_url\": \"https://.../reservations/search?page=2\", \"prev_page_url\": null, \"length_aware\": true }`\n\n- **Iterate using** `has_more_pages` **/** `next_page_url` — keep requesting the next page until `has_more_pages` is `false`. Don't hard-code a page count.\n    \n- **Don't rely on** `total` **/** `last_page`**.** Producing those requires counting the _entire_ result set, which is the slow part of a large query. If you only need the records (not a grand total), just page until you run out — this is materially faster.\n    \n\n## Timeouts\n\nRequests are subject to a **gateway timeout of roughly 30 seconds**. If a single request can't complete in that time, you'll receive a `504` **Gateway Timeout** (note: a `504` is an infrastructure-level response and may _not_ use the JSON envelope).\n\n## Raising an issue with us\n\nBefore contacting support, please confirm you have implemented **retry with back-off** and **delta loads** — these resolve the majority of reported problems.\n\nWhen you do raise an issue, include:\n\n- The **environment** (Staging / Production) and **base URL**.\n    \n- The **endpoint**, **full request body**, and **page** parameter used.\n    \n- The **HTTP status** and the **meta** + **messages** block from the response.\n    \n- The **timestamp(s)** (with timezone) and the **X-API-Key** identifier you were using (the key name/identifier — **never** your secret).\n    \n- Your **retry, concurrency and pagination** settings (so we can reproduce your access pattern).","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","isPublicCollection":false,"owner":"34889443","team":116945,"collectionId":"836595e4-d02b-4475-8dab-08f572458ee1","publishedId":"2sBY4TpJ1y","public":true,"publicUrl":"https://apidocs.high-level-software.com","privateUrl":"https://go.postman.co/documentation/34889443-836595e4-d02b-4475-8dab-08f572458ee1","customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"documentationLayout":"classic-double-column","customisation":{"metaTags":[{"name":"description","value":"This is the official Zonal API"},{"name":"title","value":"Zonal API"}],"appearance":{"default":"light","themes":[{"name":"dark","logo":"https://content.pstmn.io/5fb37b89-6517-479f-83f5-52e4ae835bdb/bG9nby5wbmc=","colors":{"top-bar":"212121","right-sidebar":"303030","highlight":"FF6C37"}},{"name":"light","logo":"https://content.pstmn.io/5fb37b89-6517-479f-83f5-52e4ae835bdb/bG9nby5wbmc=","colors":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"}}]}},"version":"8.12.8","publishDate":"2026-08-21T14:02:16.000Z","activeVersionTag":"latest","documentationTheme":"light","metaTags":{"title":"Zonal API","description":"This is the official Zonal API"},"logos":{"logoLight":"https://content.pstmn.io/5fb37b89-6517-479f-83f5-52e4ae835bdb/bG9nby5wbmc=","logoDark":"https://content.pstmn.io/5fb37b89-6517-479f-83f5-52e4ae835bdb/bG9nby5wbmc="}},"statusCode":200},"environments":[{"name":"Production","id":"f7665e51-d40d-44f6-a6e6-5e2dd4a40b70","owner":"34889443","values":[{"key":"url","value":"","enabled":true,"type":"default"},{"key":"apiKey","value":"","enabled":true,"type":"secret"},{"key":"accessToken","value":"","enabled":true,"type":"secret"},{"key":"clientToken","value":"","enabled":true,"type":"default"},{"key":"clientSecret","value":"","enabled":true,"type":"default","secret":true},{"key":"refreshToken","value":"","enabled":true,"type":"secret"}],"published":true}],"user":{"authenticated":false,"permissions":{"publish":false}},"run":{"button":{"js":"https://run.pstmn.io/button.js","css":"https://run.pstmn.io/button.css"}},"web":"https://www.getpostman.com/","team":{"logo":"https://res.cloudinary.com/postman/image/upload/t_team_logo_pubdoc/v1/team/46593abfc2eac0b4eef6124dbb5da78abf851a3d3668f3b1ddf19475eb0a1b43","favicon":"https://res.cloudinary.com/postman/image/upload/v1627647758/team/xv6uhdokgwyu7b8qrftz.ico"},"isEnvFetchError":false,"languages":"[{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"HttpClient\"},{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"RestSharp\"},{\"key\":\"curl\",\"label\":\"cURL\",\"variant\":\"cURL\"},{\"key\":\"dart\",\"label\":\"Dart\",\"variant\":\"http\"},{\"key\":\"go\",\"label\":\"Go\",\"variant\":\"Native\"},{\"key\":\"http\",\"label\":\"HTTP\",\"variant\":\"HTTP\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"OkHttp\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"Unirest\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"Fetch\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"jQuery\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"XHR\"},{\"key\":\"c\",\"label\":\"C\",\"variant\":\"libcurl\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Axios\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Native\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Request\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Unirest\"},{\"key\":\"objective-c\",\"label\":\"Objective-C\",\"variant\":\"NSURLSession\"},{\"key\":\"ocaml\",\"label\":\"OCaml\",\"variant\":\"Cohttp\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"cURL\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"Guzzle\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"HTTP_Request2\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"pecl_http\"},{\"key\":\"powershell\",\"label\":\"PowerShell\",\"variant\":\"RestMethod\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"http.client\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"Requests\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"httr\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"RCurl\"},{\"key\":\"ruby\",\"label\":\"Ruby\",\"variant\":\"Net::HTTP\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"Httpie\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"wget\"},{\"key\":\"swift\",\"label\":\"Swift\",\"variant\":\"URLSession\"}]","languageSettings":[{"key":"csharp","label":"C#","variant":"HttpClient"},{"key":"csharp","label":"C#","variant":"RestSharp"},{"key":"curl","label":"cURL","variant":"cURL"},{"key":"dart","label":"Dart","variant":"http"},{"key":"go","label":"Go","variant":"Native"},{"key":"http","label":"HTTP","variant":"HTTP"},{"key":"java","label":"Java","variant":"OkHttp"},{"key":"java","label":"Java","variant":"Unirest"},{"key":"javascript","label":"JavaScript","variant":"Fetch"},{"key":"javascript","label":"JavaScript","variant":"jQuery"},{"key":"javascript","label":"JavaScript","variant":"XHR"},{"key":"c","label":"C","variant":"libcurl"},{"key":"nodejs","label":"NodeJs","variant":"Axios"},{"key":"nodejs","label":"NodeJs","variant":"Native"},{"key":"nodejs","label":"NodeJs","variant":"Request"},{"key":"nodejs","label":"NodeJs","variant":"Unirest"},{"key":"objective-c","label":"Objective-C","variant":"NSURLSession"},{"key":"ocaml","label":"OCaml","variant":"Cohttp"},{"key":"php","label":"PHP","variant":"cURL"},{"key":"php","label":"PHP","variant":"Guzzle"},{"key":"php","label":"PHP","variant":"HTTP_Request2"},{"key":"php","label":"PHP","variant":"pecl_http"},{"key":"powershell","label":"PowerShell","variant":"RestMethod"},{"key":"python","label":"Python","variant":"http.client"},{"key":"python","label":"Python","variant":"Requests"},{"key":"r","label":"R","variant":"httr"},{"key":"r","label":"R","variant":"RCurl"},{"key":"ruby","label":"Ruby","variant":"Net::HTTP"},{"key":"shell","label":"Shell","variant":"Httpie"},{"key":"shell","label":"Shell","variant":"wget"},{"key":"swift","label":"Swift","variant":"URLSession"}],"languageOptions":[{"label":"C# - HttpClient","value":"csharp - HttpClient - C#"},{"label":"C# - RestSharp","value":"csharp - RestSharp - C#"},{"label":"cURL - cURL","value":"curl - cURL - cURL"},{"label":"Dart - http","value":"dart - http - Dart"},{"label":"Go - Native","value":"go - Native - Go"},{"label":"HTTP - HTTP","value":"http - HTTP - HTTP"},{"label":"Java - OkHttp","value":"java - OkHttp - Java"},{"label":"Java - Unirest","value":"java - Unirest - Java"},{"label":"JavaScript - Fetch","value":"javascript - Fetch - JavaScript"},{"label":"JavaScript - jQuery","value":"javascript - jQuery - JavaScript"},{"label":"JavaScript - XHR","value":"javascript - XHR - JavaScript"},{"label":"C - libcurl","value":"c - libcurl - C"},{"label":"NodeJs - Axios","value":"nodejs - Axios - NodeJs"},{"label":"NodeJs - Native","value":"nodejs - Native - NodeJs"},{"label":"NodeJs - Request","value":"nodejs - Request - NodeJs"},{"label":"NodeJs - Unirest","value":"nodejs - Unirest - NodeJs"},{"label":"Objective-C - NSURLSession","value":"objective-c - NSURLSession - Objective-C"},{"label":"OCaml - Cohttp","value":"ocaml - Cohttp - OCaml"},{"label":"PHP - cURL","value":"php - cURL - PHP"},{"label":"PHP - Guzzle","value":"php - Guzzle - PHP"},{"label":"PHP - HTTP_Request2","value":"php - HTTP_Request2 - PHP"},{"label":"PHP - pecl_http","value":"php - pecl_http - PHP"},{"label":"PowerShell - RestMethod","value":"powershell - RestMethod - PowerShell"},{"label":"Python - http.client","value":"python - http.client - Python"},{"label":"Python - Requests","value":"python - Requests - Python"},{"label":"R - httr","value":"r - httr - R"},{"label":"R - RCurl","value":"r - RCurl - R"},{"label":"Ruby - Net::HTTP","value":"ruby - Net::HTTP - Ruby"},{"label":"Shell - Httpie","value":"shell - Httpie - Shell"},{"label":"Shell - wget","value":"shell - wget - Shell"},{"label":"Swift - URLSession","value":"swift - URLSession - Swift"}],"layoutOptions":[{"value":"classic-single-column","label":"Single Column"},{"value":"classic-double-column","label":"Double Column"}],"versionOptions":[],"environmentOptions":[{"value":"0","label":"No Environment"},{"label":"Production","value":"34889443-f7665e51-d40d-44f6-a6e6-5e2dd4a40b70"}],"canonicalUrl":"https://apidocs.high-level-software.com/view/metadata/2sBY4TpJ1y"}