Getting started

Access, authentication and conventions for the Bookline Partner API.

Getting access

Once your partnership is approved, Bookline issues you:

an API key,
your partner_id, which appears in most paths, and
the base URL to call.

Authentication

Every request carries the API key in an apikey header. There is no OAuth handshake and no bearer token for the API itself.

curl 'https://<partner-api-host>/<partner_id>/integrations/<integration_id>/whatsapp-messages/<message_id>' \
  -H 'apikey: <your-api-key>'

Treat the key like a password: it is not scoped per venue, so anyone holding it can act for your whole partner account. Keep it server-side — never in a mobile app, a browser bundle, or a repository.

Conventions

Phone numbers are E.164 — a leading + and country code, no spaces or punctuation: +34933803348.

Timestamps are ISO 8601 date-times.

Errors come back with the usual HTTP semantics. 422 is the one you will meet most while integrating: the request was well-formed JSON but a field failed validation, and the body tells you which.

Code	What it means
`400`	The request itself is wrong — a malformed phone number, for instance.
`403`	The credential is not allowed to do this.
`404`	The thing you addressed does not exist.
`422`	Validation failed. The body lists the offending fields.
`429`	You exceeded a quota.

The shape of a 422 body is HTTPValidationError: a detail array where each entry names the field (loc), the problem (msg) and its type.

Where to next


Call Tokens	Place a pre-configured call, with quota control.
Whatsapp Messages	Send a booking message; read its delivery status.
Incoming call data	Receive data about a call as it arrives.
On/offboarding requests	Add and remove venues.
Models	Every request and response object.