Developer API v0.7.2

Kismet Developer API v0.7.2 contains 23 reviewed operations for collection-scoped catalog groups and published resources, natural-language BookableProduct discovery, synchronized availability, fixture manifests, TEST booking requests, and branded guest accounts. Authorized collection administrators and developers can create scoped TEST and LIVE applications, installations, and credentials from the collection’s Kismet settings.

Beta access boundary

The API remains account-scoped beta. Turn on Developer mode, open the collection’s Settings → Developer API tab, and follow Create a Developer API application and key. Never infer scope or environment from the credential string, and never place an sk_ server credential in browser code.

Operation families

Family	Operations	Current contract
Catalog groups	2	Generic group projection with Vacation Rental pack vocabulary
Published rentals and manager content	5	Read-only, collection/resource grants
Natural-language search	1	Ranked BookableProduct discovery; not availability, quotes, or booking
Calendar and collection availability	2	Synced commercial reads; indicative, not quotes
Articles	2	Published Kismet block content only
Fixture registry	2	Manifest metadata; installable public package is separate
Booking requests	1	TEST only; no charge or PMS mirror
Branded guest authentication	4	Server-key, same-origin BFF, CSRF protected
Guest account and saves	4	Signed-in, collection-filtered self-service

The signed-in booking flow uses the existing booking-request operation with a BFF-held guest token; it is not a second endpoint.

Authentication and authorization

Every operation uses Authorization: Bearer …. Kismet resolves the application, installation environment, positive collection/resource grants, and capabilities server-side. URL identifiers narrow a request; they never expand authority.

• Publishable keys are for explicitly browser-safe read surfaces and authorized origins.
• Restricted server keys are required for guest auth, guest account operations, and writes.
• TEST and LIVE are installation properties. TEST bookings and telemetry remain sandboxed even when they use real CMS content.

Pricing and booking semantics

Calendar rates, pricing.nightlyFrom, and availability display fields come from Kismet’s synchronized calendar plane. They are indicative display values, not quotes. They carry no taxes, final total, payment authority, expiry, or booking action.

createVacationRentalBookingRequest is real sandbox behavior in TEST: it records a sandbox reservation and lights up the guestbook, journey, and telemetry planes, while suppressing PMS mirroring and charges. LIVE returns SANDBOX_ONLY until the Kismet Pay lane is available.

Live checkout is not part of v0.7

The sandbox booking-request operation is not a checkout API. The intended LIVE developer surface is a Kismet Booking Drawer backed by short-lived server-authorized booking sessions and Kismet-hosted or tokenized payment fields. Those operations and the installable drawer will appear here only after they are implemented and reviewed.

Need live booking and payments? Kismet’s Booking Drawer and payment integration are currently installed with our engineering team. Tell us about your project, schedule a technical kickoff, and we’ll help install and validate the fixture in your site. Request implementation access.

SDK and Developer MCP

The REST API is the deployed application contract, and the SDK is its typed runtime client. The Developer MCP is a separate, public build-time agent surface at https://mcp.kismet.travel/developer-mcp: it lets coding agents search these docs, retrieve versioned recipes, inspect canonical operations and Fixture coverage, plan and validate integrations, explain stable problems, and inspect what a credential can do.

The Developer MCP must not become a guest-runtime API or receive Kismet guest tokens. Generated sites call the SDK or REST API through the documented browser/BFF boundaries. Agents without an MCP client can still use llms.txt and the Markdown twin linked from each operation page; the MCP serves the same generated corpus.

Install Kismet Developer in Claude or Codex, or connect it in Lovable.

Reference formats

• OpenAPI v0.7.2 JSON
• Generated HTML pages in the API reference navigation
• A Markdown twin linked from every operation page
• llms.txt for coding agents

What is still not public

• a generally advertised production API hostname and support policy;
• credential usage reporting and automated rotation workflows;
• an interactive authenticated request console;
• LIVE payment/charge and PMS-write semantics;
• a public fixture npm package and artifact delivery;
• Developer MCP tier 2: OAuth sign-in and runtime read tools scoped to an installation. Build-time integration validation is tier 1;
• semantic-ranking evidence in the isolated evaluation environment. Route transport, authorization boundaries, validation, revoked-key handling, repeatability, and SDK parsing pass; its disposable database lacks the search corpus schema and therefore currently returns the documented deterministic fallback rather than semantic ranking.