# Developer API v0.7

> The reviewed, access-controlled Kismet Developer API contract and its current release boundary.


Kismet Developer API v0.7 contains **20 reviewed operations** for collection-scoped published resources, synchronized availability, fixture manifests, TEST booking requests, and branded guest accounts. Beta credentials and evaluation base URLs are issued directly to approved teams while self-service access and public hosting are completed.

> **Beta access boundary**
>
> The API remains access controlled. Kismet issues opaque TEST or LIVE credentials and an evaluation base URL directly to approved developers. Never infer scope or environment from the credential string, and never place an `sk_` server credential in browser code.

## Operation families

| Family | Operations | Current contract |
| --- | ---: | --- |
| Published rentals and manager content | 5 | Read-only, collection/resource grants |
| Calendar and collection availability | 2 | Synced commercial reads; indicative, not quotes |
| Articles | 2 | Published Kismet block content only |
| Fixture registry | 2 | Manifest metadata; installable public package is separate |
| Booking requests | 1 | TEST only; no charge or PMS mirror |
| Branded guest authentication | 4 | Server-key, same-origin BFF, CSRF protected |
| Guest account and saves | 4 | Signed-in, collection-filtered self-service |

The signed-in booking flow uses the existing booking-request operation with a BFF-held guest token; it is not a second endpoint.

## Authentication and authorization

Every operation uses `Authorization: Bearer …`. Kismet resolves the application, installation environment, positive collection/resource grants, and capabilities server-side. URL identifiers narrow a request; they never expand authority.

- Publishable keys are for explicitly browser-safe read surfaces and authorized origins.
- Restricted server keys are required for guest auth, guest account operations, and writes.
- TEST and LIVE are installation properties. TEST bookings and telemetry remain sandboxed even when they use real CMS content.

## Pricing and booking semantics

Calendar rates, `pricing.nightlyFrom`, and availability `display` fields come from Kismet's synchronized calendar plane. They are indicative display values, not quotes. They carry no taxes, final total, payment authority, expiry, or booking action.

`createVacationRentalBookingRequest` is real sandbox behavior in TEST: it records a sandbox reservation and lights up the guestbook, journey, and telemetry planes, while suppressing PMS mirroring and charges. LIVE returns `SANDBOX_ONLY` until the Kismet Pay lane is available.

> **Live checkout is not part of v0.7**
>
> The sandbox booking-request operation is not a checkout API. The intended LIVE developer surface is a Kismet Booking Drawer backed by short-lived server-authorized booking sessions and Kismet-hosted or tokenized payment fields. Those operations and the installable drawer will appear here only after they are implemented and reviewed.
>
> **Need live booking and payments?** Kismet's Booking Drawer and payment integration are currently installed with our engineering team. Tell us about your project, schedule a technical kickoff, and we'll help install and validate the fixture in your site. [Request implementation access](mailto:engineering@makekismet.com?subject=Booking%20Drawer%20implementation%20access).

## SDK and Developer MCP

The REST API is the deployed application contract, and the SDK is its typed runtime client. The [**Developer MCP**](https://developers.kismet.travel/mcp.md) is a separate, build-time agent surface, live at `https://mcp.kismet.travel/developer-mcp`: it lets coding agents search these docs, retrieve versioned implementation recipes with an honest status (available, preview, planned), and inspect what a credential can do.

The Developer MCP must not become a guest-runtime API or receive Kismet guest tokens. Generated sites call the SDK or REST API through the documented browser/BFF boundaries. Agents without an MCP client can still use [`llms.txt`](/llms.txt) and the Markdown twin linked from each operation page; the MCP serves the same generated corpus.

## Reference formats

- [OpenAPI v0.7 JSON](/openapi.json)
- Generated HTML pages in the **API reference** navigation
- A Markdown twin linked from every operation page
- [`llms.txt`](/llms.txt) for coding agents

## What is still not public

- self-service application and credential creation;
- a generally advertised production API hostname and support policy;
- an interactive authenticated request console;
- LIVE payment/charge and PMS-write semantics;
- a public fixture npm package and artifact delivery;
- Developer MCP tier 2: OAuth sign-in, runtime read tools scoped to an installation, and integration validation (tier 1, recipes and docs, is live);
- deployment/live-smoke evidence for the just-merged guest lifecycle stack.