• KORA REST API Guide for Developers
  • 1. Introduction
  • 2. General description
  • 3. Authentication and Security
  • 4. Structure of Requests and Responses
  • 5. Usage examples in different languages
  • 6. Best Practices
  • 7. Workflows
  • 8. Endpoints
  • 9. Widget
  • Contact and support

1. Introduction

This document is a guide aimed at developers who need to integrate with KORA efficiently. The KORA REST API provides access to the KORA Travel platform, allowing the Bookings management.

If you prefer developer-style documentation, head straight to the Swagger API Docs: API Documentation

2. General description

API Version: 1.0.0
Sandbox Base URL: <https://app.sandbox.kora.travel/api/>
Data Format: JSON
Supported Protocols: HTTPS

3. Authentication and Security

The API uses Bearer Token authentication. This token must be generated from the KORA APP graphical interface. To generate it, contact an administrator from your organization or KORA support.

Authentication example

GET /bookings HTTP/1.1
Host: app.sandbox.kora.travel
Authorization: Bearer {token}

3.1. Hotel Impersonation

There are three types of tokens:

1. Organization-Level Token

   Grants access to all resources under a specific organization. Useful for managing all organization information.

2. Hotel-Level Token

   Grants access to a specific hotel (establishment). The token is scoped to that hotel only and cannot access resources from other hotels in the organization.

3. Organization-Level Token with Hotel Impersonation

   This is an organization-scoped token with the additional ability to impersonate a specific hotel (establishment). It allows actions such as registering bookings directly for a selected hotel.

   Use this token when performing actions on behalf of individual establishments while maintaining centralized access.

   If you do not provide establishment_id on requests that have hotel impersonation, it will be recorded in the establishment or organization that owns the connection.

   From this point in the documentation onward, we will refer to this functionality as Hotel Impersonation.

4.Structure of Requests and Responses

Common Headers

Content-Type: application/json
Authorization: Bearer {token}

Example of a successful response

{
    "data": DataSchema,
    "links": {
        "first": "url",
        "last": "url",
        "prev": null,
        "next": "url"
        },
    "meta": {
        "current_page": 1,
        "from": 1,
        "last_page": 71,
        "links": [...],
        "path": "",
        "per_page": 20,
        "to": 20,
        "total": 1420
        }
}