REST API

For full API documentation, visit /docs/api.

Getting Started

Create a token under Integrations > API Tokens, choosing only the scopes the integration needs. Send it as a bearer token: Authorization: Bearer cbms_.... Every other endpoint takes a campground_id; get it, along with the park's timezone, default check-in and check-out times and whether it collects vehicle registrations, from GET /campground.

Token Expiry

A token can be set to expire in 30 days, 90 days, a year, or never. The token list shows the expiry date, and the park owner and the person who created the token are emailed a week before it expires. To keep an integration running past that date, create a new token and update the integration before the old one lapses. Tokens created before 10 September 2026 expire 90 days after they were created.

Rate Limits

Each token may make 200 requests a minute and 3,000 an hour. Every response carries X-RateLimit-Limit and X-RateLimit-Remaining; a request over the limit gets a 429 with a Retry-After header. Twenty failed authentication attempts from one address in a minute also return 429.

Errors

Every error response is JSON with a message. Validation errors (422) add an errors object keyed by field, for example {"message": "The guests field is required.", "errors": {"guests": ["The guests field is required."]}}. An error key repeating the message is also present for integrations built against earlier versions.

Idempotent Requests

To make a create safe to retry, send an Idempotency-Key header (any string up to 255 characters, for example your own order number) with the POST. If the same token sends the same key again within 24 hours, the original response is returned with an Idempotent-Replayed: true header instead of a second record being created. Reusing a key with a different request body returns 422.

Updating Records

Updates are partial: send only the fields to change. Sending a field as null clears it, so {"access_code": null} removes the access code. To cancel a booking, use POST /bookings/{id}/cancel (the Bookings (Cancel) scope); sending status: cancelled to the update endpoint is refused. Unknown fields are refused with a 422 naming them, so a misspelt field never silently does nothing.

Emails

When you create or modify records via the API, the corresponding emails (booking confirmations, invoice notifications, cancellation notices, etc.) are not sent automatically.

Endpoints and Fields

Every endpoint, with its fields, filters, scopes and example responses, is listed at /docs/api.