API & integration

One API across the whole platform.

TourCore is API-first. External systems — from OTAs to DATEV — talk via REST endpoints. OpenAPI spec, versioned schema, idempotent mutations.

Full OpenAPI 3 spec. Generated TypeScript / Python client types, verified in CI.

Tenant-issued API keys with scope binding. Read-only keys for reporting, service keys for booking write access.

Booking status, payment updates, supplier confirmations — subscribable with HMAC-SHA-256 signed payloads + retry logic.

`X-Tenant-Slug` header or domain resolution. Clean separation in every response, no tenant id in cleartext URL.

Write endpoints accept `Idempotency-Key` — safe to retry on timeouts or network hiccups.

Staging tenant with realistic mock data. Test in sandbox first, then flip to live — one flag.

Is the API public?: No — during the beta phase API access is by request. Documentation and sandbox credentials follow a short onboarding call.
What rate limits apply?: 500 requests/minute per tenant by default; higher limits configurable for Enterprise tenants.
What is the versioning model?: Semver: major versions for breaking changes, with a migration window of at least 6 months. Minor versions are backwards-compatible.
SDKs available?: TypeScript SDK generated from the OpenAPI spec. Python bindings on request.

API access or integration architecture?

We send the spec, sandbox credentials and schedule a technical call within 24 hours.