Skip to content
GuestMaker by Hotelinking Developers
Request access
Skip to content
GUESTMAKER FOR DEVELOPERS

Your systems.
One guest record.

Connect your PMS, booking engines and every strategic system in your hotel group to the guest record behind each GuestMaker conversation.

Sync reservations and guests, send events, receive signed webhooks and connect loyalty, with documented APIs and integration guides.

API v1Bearer gmkr_JSON over HTTPSSigned webhooks
Illustrative example · Grand Hotel
simulated
Response awaiting request…
Webhook streamX-Webhook-Signature
01 Your hotel system
02 The guest record
03 Your guest journey
04 The right channel
A PRACTICAL STARTING POINT
01 / 06

Make the connection.
Start with one stay.

One call creates the reservation, links its guests to a contact and a hotel, and starts the journeys that listen for it. Send it again with the same reservation_id and it updates instead of duplicating.

POST/api/v1/reservations
1curl -X POST https://www.guestmaker.ai/api/v1/reservations \
2 -H "Authorization: Bearer $GMKR_API_KEY" \
3 -H "Content-Type: application/json" \
4 -d '{
5 "reservation_id": "RES-2026-001234",
6 "hotel_name": "Grand Hotel",
7 "check_in": "2026-03-15",
8 "check_out": "2026-03-18",
9 "status": "confirmed",
10 "source": "pms",
11 "guests": [{ "first_name": "Alex",
12 "email": "alex@example.com" }]
13 }'
Upserts on reservation_id · up to 100 guests, 100 stays and 100 extras per reservation
THE INTEGRATION SURFACE
02 / 06

Build around the guest.

Every area shares one guest record, documented credentials and paths for each API family. Request only the scopes your integration needs.

https://www.guestmaker.ai/api/v1
Stays & guests

Reservations

Create or update reservations with guests, room stays and extras from your PMS or booking engine.

POST/reservations
POST/reservations/batch≤ 50
reservations:write↗
Stays & guests

Guests

Create and manage guest contacts with their bookings, linked to hotels for AI-powered conversations.

POST/guests
POST/guests/batch≤ 500
GET/guestsby phone
guests:read · guests:write↗
Stays & guests

Custom fields

Extend guest profiles with partner data that hotel teams can use to build segments.

POST/fields
GET/fields
custom_fields:write↗
Behaviour

Website & booking-engine events

One contract, three ways in: server API, webhook with field mapping, or browser SDK.

POST/website-events≤ 50
POST/website-events/hooks/…
gme_sk_ · gme_wh_ · gme_pk_↗
Behaviour

CDP

Anonymous visitor tracking, identity resolution and post-checkout reservation ingestion.

POST/cdp/events
POST/cdp/identify
POST/cdp/reservations/bulk≤ 5,000
cdp:read · cdp:write↗
Loyalty

Loyalty

Your backend acts for the hotel: check, enroll, award, redeem and read tiers and rewards.

GET/loyalty/check
POST/loyalty/enroll
POST/loyalty/points
guests:read · guests:write↗
LoyaltyNew

Cash credit

Points as money credit on direct bookings, folio charges and checkout. Quote, hold, confirm.

GET/loyalty/credit/quote
POST/loyalty/credit/hold
POST/loyalty/credit/confirm
guests:read · guests:write↗
Loyalty

Loyalty SSO

A standard OpenID Connect provider. Guests sign in and you personalise the booking flow.

AUTH/api/oidc/auth · /api/oidc/token
GET/api/loyalty/me/balance
GET/api/loyalty/me/transactions
id_token + access token↗
Comms

Webhooks

Real-time, signed notifications for messages, contacts, conversations, journeys and stays.

HOOKmessage.* · contact.* · journey.*
HOOKreservation.checked_in
Dashboard configuration↗
Comms

Newsletter signup

Embed a signup form. Confirmed subscribers become contacts with marketing consent.

POST/newsletter/subscribe
GET/newsletter/config
publishable key gm_pub_↗
Comms

CTI / Telephony

Inbound screen-pop, click-to-call, call recording and per-contact call history.

POST/api/webhooks/cti
POST/api/contacts/{id}/call
GET/api/contacts/{id}/calls
Webhook token · authenticated call/history routes↗
B2B

B2B CRM

Agencies, tour operators and corporate accounts with hierarchy, deals and attribution.

POST/b2b/accounts
PATCH/b2b/accounts/{id}
POST/b2b/deals
b2b:read · b2b:write↗
WEBSITE & BOOKING-ENGINE EVENTS
03 / 06

Three doors in.
One contract.

Tell GuestMaker what visitors do on a website or booking engine, such as leaving a booking half-finished, and start a journey from it.

Nothing to register first: send a valid event name allowed by the active source and it appears in the journey editor. Each source gets its own key, so you can pause or replace one without touching the others.

DOOR 01most reliable

Server API

Your backend or booking engine calls the API and chooses exactly when to send and retry.

keygme_sk_…
sendPOST /api/v1/website-events
DOOR 02no code

Webhook & field mapping

A booking engine posts its own JSON to a URL. Map its fields once in Settings and preview the result against a real request.

key…/hooks/gme_wh_…
signX-GM-Signature (optional)
DOOR 03sees the tab close

Browser SDK

Your booking page runs gm-events.js, the only door that sees a visitor leave. Works from Google Tag Manager too.

keygme_pk_… (public)
scopeyour allowed origins
cart.abandoned→ contact + consent checks→ journey trigger→ wait→ email with valid consent→ exits on configured completion event or booking signal
POST/api/v1/website-events202 Accepted
1{
2 "event": "cart.abandoned",
3 "idempotency_key": "cart_8841",
4 "contact": { "email": "ana@example.com", "language": "es" },
5 "context": {
6 "hotel_code": "HD-MAD", "cart_id": "8841",
7 "stage": "payment",
8 "check_in": "2026-11-20", "check_out": "2026-11-23",
9 "value": 612.4, "currency": "EUR",
10 "resume_url": "https://book.example.com/resume?cart=8841"
11 }
12}
Up to 50 events per request · add "test": true to validate without touching a guest

Every event gets an answer.

Each result says what happened and why, so a claim never disappears silently. Pick a code.

NORMAL OUTCOMES · INSIDE A 202
ACCEPTED, BUT SOMETHING DID NOT HAPPEN
REFUSED
consent_evidence_missingHTTP 202Consent claimed without evidence
Whyemail_marketing was true but the exact consent sentence or a valid capture timestamp was missing. Stale evidence has its own result code.FixSend the exact wording the visitor agreed to, and when.
OUTBOUND WEBHOOKS
04 / 06

Every change,
signed and delivered.

Configure endpoints in your dashboard and hear about it the moment a guest replies, a contact changes or a journey completes. Set a signing secret in the webhook’s dashboard configuration to receive signed payloads.

Messages
message.receivedmessage.sentmessage.deliveredmessage.read
Contacts
contact.createdcontact.updatedcontact.deleted
Conversations
conversation.createdconversation.closed
Journeys
journey.startedjourney.completedjourney.failed
Broadcasts
broadcast.sentbroadcast.completed
Stays
reservation.checked_inreservation.checked_out
Check-in and check-out timing. These fire from a daily date-scan, not in real time. Each delivery carries a scheduled_for object with the guest's expected local time (defaults 15:00 and 12:00, hotel timezone).
verify-webhook.jsNode.js · Python · PHP
1import express from "express";
2import { createHmac, timingSafeEqual } from "node:crypto";
3const app = express();
4const secret = process.env.GMKR_WEBHOOK_SECRET;
5
6app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
7 const timestamp = req.get("X-Webhook-Timestamp");
8 const signature = req.get("X-Webhook-Signature");
9 if (!secret || !timestamp || !signature || !Buffer.isBuffer(req.body))
10 return res.sendStatus(401);
11 const expected = "sha256=" + createHmac("sha256", secret)
12 .update(timestamp + ".").update(req.body).digest("hex");
13 const actual = Buffer.from(signature);
14 const wanted = Buffer.from(expected);
15 if (actual.length !== wanted.length || !timingSafeEqual(actual, wanted))
16 return res.sendStatus(401);
17 // Persist the verified payload to your queue before acknowledging.
18 // Add your durable queue write here; acknowledge after it succeeds.
19 return res.sendStatus(200);
20});
X-Webhook-SignatureHMAC-SHA256 of timestamp + "." + raw body X-Webhook-EventThe event type being delivered X-Webhook-DeliveryIdentifies a delivery attempt; use stable payload IDs for idempotency X-Webhook-TimestampISO 8601 time of the event
GO A LITTLE FURTHER
05 / 06

Built for hotel technology.

All documentation ↗
LOYALTY · CASH CREDIT · SSO

Let the guest bring their membership.

Two integration models, chosen by who is acting. Booking-engine integrations can use both.

SERVER-TO-SERVER
Loyalty REST API
Your backend acts for the hotel: look up any guest, enroll, award, redeem and sync points.
GUEST SIGN-IN · OIDC
Loyalty SSO
The guest signs in with Authorization Code + PKCE. Read only their tier, balance and history.
Read the loyalty guide ↗
Cash creditNew

Members spend points as money on direct bookings, folio charges and at checkout, through an atomic lifecycle.

01 Quote GET /loyalty/credit/quote
02 Hold POST /loyalty/credit/hold
03 Confirm POST /loyalty/credit/confirm
04 Release POST /loyalty/credit/release
05 Reverse POST /loyalty/credit/reverse
scope guests:read · guests:write · idempotent on external_reference_id
call_ringing · inboundscreen pop
AM
Alex Morgan
+34 600 111 222 · matched by E.164
Open
call_ringingcall_answeredcall_hangupcall_missedrecord_availablecall_completed
CTI · TELEPHONY

Know the guest before you say hello.

Inbound screen-pop, click-to-call, call recording and a per-contact call history. Every provider uses the same unified contract, so agents get the same experience on supported phone providers.

Read the CTI guide ↗
RESERVATION → ACCOUNT · FIRST MATCH WINS
1Agency codematched ✓
2Promo or rate codepromo_codes[]
3Mirai agency IDmirai_agency_id
4Email domainsuggestion only
B2B CRM

Every agency, operator and account.

Model travel agencies, tour operators and corporate accounts in a parent/child hierarchy up to three levels deep, with deals and automatic reservation attribution.

Read the B2B guide ↗
BUILT TO BE RELIED ON
06 / 06

Ready for production.
Safe to retry.

Use the documented limits, error codes and retry rules for each endpoint as your integration grows.

RATE LIMITS1,000 req / min / keyDefault: 1,000 requests per minute per API key. Limits depend on the key and endpoint. Honour Retry-After on HTTP 429.
IDEMPOTENCYSafe endpoint-specific retriesReuse reservation_id for reservation updates. For events and loyalty, use the endpoint’s documented idempotency field.
BATCH & BULK5,000 per bulk jobBatch 50 reservations or 500 guests per call, with partial success. Bulk CDP ingestion returns 202 and a batch_id.
ERRORS{ "success": false,
"error": { "message": "Validation failed",
"code": "VALIDATION_ERROR",
"details": { "phone": ["Invalid phone"] } } }Error formats vary by API family. Honour Retry-After for 429. Retry transient 5xx with backoff; inspect error codes and per-event results.
WEBHOOK RELIABILITY2xx acknowledge promptlyVerify signatures before accepting. X-Webhook-Delivery identifies an attempt. Make processing idempotent using stable identifiers in the payload.
SANDBOXMock / LiveExplore sample responses in Mock mode. Live mode sends requests with your API key.
LET'S BUILD TOGETHER

Bring your systems
to GuestMaker.

Tell us what you're connecting.

Pick the systems in your stack. We'll help you choose the right endpoints, scopes and rollout for your hotel group.

access-request.json2 systems
SCOPES & KEYS
reservations:writeguests:writegme_wh_ / gme_sk_
ENDPOINTS YOU'LL USE
POST/reservationsPMS · Booking engine
POST/reservations/batchPMS
HOOKreservation.checked_inPMS
POST/website-eventsBooking engine
Cookie policy