Developer API v0.7

Kismet Developer API v0.7 contains 20 reviewed operations for collection-scoped published resources, synchronized availability, fixture manifests, TEST booking requests, and branded guest accounts. Beta credentials and evaluation base URLs are issued directly to approved teams while self-service access and public hosting are completed.

Beta access boundary

The API remains access controlled. Kismet issues opaque TEST or LIVE credentials and an evaluation base URL directly to approved developers. Never infer scope or environment from the credential string, and never place an sk_ server credential in browser code.

Operation families

Family	Operations	Current contract
Published rentals and manager content	5	Read-only, collection/resource grants
Calendar and collection availability	2	Synced commercial reads; indicative, not quotes
Articles	2	Published Kismet block content only
Fixture registry	2	Manifest metadata; installable public package is separate
Booking requests	1	TEST only; no charge or PMS mirror
Branded guest authentication	4	Server-key, same-origin BFF, CSRF protected
Guest account and saves	4	Signed-in, collection-filtered self-service

The signed-in booking flow uses the existing booking-request operation with a BFF-held guest token; it is not a second endpoint.

Authentication and authorization

Every operation uses Authorization: Bearer …. Kismet resolves the application, installation environment, positive collection/resource grants, and capabilities server-side. URL identifiers narrow a request; they never expand authority.

• Publishable keys are for explicitly browser-safe read surfaces and authorized origins.
• Restricted server keys are required for guest auth, guest account operations, and writes.
• TEST and LIVE are installation properties. TEST bookings and telemetry remain sandboxed even when they use real CMS content.

Pricing and booking semantics

Calendar rates, pricing.nightlyFrom, and availability display fields come from Kismet’s synchronized calendar plane. They are indicative display values, not quotes. They carry no taxes, final total, payment authority, expiry, or booking action.

createVacationRentalBookingRequest is real sandbox behavior in TEST: it records a sandbox reservation and lights up the guestbook, journey, and telemetry planes, while suppressing PMS mirroring and charges. LIVE returns SANDBOX_ONLY until the Kismet Pay lane is available.

Live checkout is not part of v0.7

The sandbox booking-request operation is not a checkout API. The intended LIVE developer surface is a Kismet Booking Drawer backed by short-lived server-authorized booking sessions and Kismet-hosted or tokenized payment fields. Those operations and the installable drawer will appear here only after they are implemented and reviewed.

Need live booking and payments? Kismet’s Booking Drawer and payment integration are currently installed with our engineering team. Tell us about your project, schedule a technical kickoff, and we’ll help install and validate the fixture in your site. Request implementation access.

SDK and Developer MCP

The REST API is the deployed application contract, and the SDK is its typed runtime client. The Developer MCP is a separate, build-time agent surface, live at https://mcp.kismet.travel/developer-mcp: it lets coding agents search these docs, retrieve versioned implementation recipes with an honest status (available, preview, planned), and inspect what a credential can do.

The Developer MCP must not become a guest-runtime API or receive Kismet guest tokens. Generated sites call the SDK or REST API through the documented browser/BFF boundaries. Agents without an MCP client can still use llms.txt and the Markdown twin linked from each operation page; the MCP serves the same generated corpus.

Reference formats

• OpenAPI v0.7 JSON
• Generated HTML pages in the API reference navigation
• A Markdown twin linked from every operation page
• llms.txt for coding agents

What is still not public

• self-service application and credential creation;
• a generally advertised production API hostname and support policy;
• an interactive authenticated request console;
• LIVE payment/charge and PMS-write semantics;
• a public fixture npm package and artifact delivery;
• Developer MCP tier 2: OAuth sign-in, runtime read tools scoped to an installation, and integration validation (tier 1, recipes and docs, is live);
• deployment/live-smoke evidence for the just-merged guest lifecycle stack.