API reference
The RentalTide API lets you programmatically manage bookings, inventory, customers, transactions, and more. Every action available in the dashboard is available through the API.
Base URL
All API requests are made to:
Authentication
Every request sends its credential in the Authorization header as a Bearer token. This API does not read an x-api-key header. (The reseller channel API is a separate API with its own keys; see Resellers.)
The credential you send decides what you can reach.
Scoped API key (your own integrations)
For an integration you run on your own servers, create a scoped API key: open App Store > API Key, choose New key under Scoped keys, name it and tick the access it needs. Only the account owner can create or revoke keys. The full key is shown once, when you create it; RentalTide keeps only a fingerprint of it.
Call the API through the gateway at /api/v1:
- A
GETneeds theread:scope for that resource, and any other method needs thewrite:scope. A key withread:bookingsandread:inventorycan read bookings and inventory and change nothing. - A path that no scope covers, such as account settings or staff management, is refused with
403 insufficient_scope. - A key works only under
/api/v1. Sent straight to another path, it is refused with401. - A key covers your whole account. Pass a
location_idto read one location; the key itself is not limited to one. - Booking records include the renter's name and contact details. No scope removes them.
- An account can have up to 10 keys. Revoking one stops it within seconds.
The interactive reference at v3.api.rentaltide.com/docs lists every endpoint you can call this way, with the scope each one needs.
A key acts for your whole account, within its scopes, until you revoke it. Keep it on your server: never in a web page, an app or a public repository. Create one key per integration so you can revoke them separately.
OAuth app token (apps other merchants install)
If you are building an app for other RentalTide merchants, use OAuth instead. The merchant approves your app's scopes when they install it, and your app calls the same /api/v1 paths with its access token in place of a key. Scopes and limits work as above. See Server-to-server API for getting a token and Scopes for the full list.
Legacy API keys
The older 64-character keys under Legacy keys in the API Key app are not tied to a user, so they have no role and no staff permissions, and permissions cannot be added to them. Endpoints that require a staff permission, including bookings and schedules, answer them with 403:
To read bookings, use a scoped key instead.
Dashboard session token
The dashboard signs its own requests with the signed-in user's token, which carries that user's role and permissions. These tokens expire after a short time and are not meant for integrations.
Request format
All request bodies must be JSON with the Content-Type: application/json header.
Response format
Every response returns JSON. Successful responses use this structure:
Error responses include a message and an error code:
HTTP status codes
| Code | Meaning |
|---|---|
200 | Success |
201 | Created |
400 | Bad request — check the request body |
401 | Unauthorized — missing or invalid credentials |
403 | Forbidden — valid credentials but insufficient permissions |
404 | Not found |
409 | Conflict — resource state prevents the action |
429 | Rate limited — slow down |
500 | Internal server error |
Rate limits
API requests are rate-limited per authentication credential:
| Plan | Limit |
|---|---|
| Standard | 100 requests per minute |
| Enterprise | 500 requests per minute |
When you exceed the limit, the API returns a 429 status with a Retry-After header indicating how many seconds to wait.
Webhook deliveries and dashboard usage do not count against your API rate limit.
Pagination
List endpoints return paginated results. Use the limit and offset query parameters to navigate pages.
The response includes a total count:
API sections
Webhooks
RentalTide can send real-time event notifications to your server. Configure webhook endpoints from Settings > Webhooks in the dashboard.
Supported events
| Event | Fired when |
|---|---|
booking.created | A new booking is placed |
booking.updated | A booking is modified |
booking.cancelled | A booking is cancelled |
booking.checked_in | A customer checks in |
booking.checked_out | A rental is returned |
payment.completed | A payment is captured |
payment.refunded | A refund is issued |
customer.created | A new customer record is created |
Webhook payload
Each webhook request includes an X-RentalTide-Signature header. Verify this HMAC-SHA256 signature against your webhook secret to confirm the request came from RentalTide.