Hostaway API
Hostaway is an AI-powered vacation rental management platform that unifies property management, channel distribution, direct booking, guest messaging, and revenue optimization across Airbnb, Vrbo, Booking.com, Expedia, and more. Hostaway exposes a REST API, but a Supergood-managed API lets you reliably pull listings, reservations, calendar availability, guests, messages, and reviews—and push updates like new bookings, rate and availability changes, automated guest messages, and tasks back into Hostaway.
What is Hostaway?
Hostaway is an AI-powered vacation rental management platform that consolidates property management, channel distribution, direct booking, guest communication, and revenue optimization for short-term rental operators. Property managers use Hostaway to sync listings and availability across major OTAs, automate guest messaging, manage reservations and reviews, optimize pricing, and connect cleaning, smart-lock, accounting, and CRM tools through a 200+ partner integration marketplace.
Core product areas include:
- Property Management System (central PMS for vacation rental operations)
- Channel Management (Airbnb, Vrbo, Booking.com, Expedia, Google Vacation Rentals, Marriott Homes & Villas)
- Direct Booking tools and a hosted booking website/engine
- Unified Guest Messaging across every connected channel
- Revenue Management with AI-driven dynamic pricing and insights
- Review Management and a 200+ app Integration Marketplace
Common data entities:
- Listings, Units, Amenities, Photos, Custom Fields
- Reservations, Bookings, Guests, Coupons, Channel Mappings
- Calendar Availability, Pricing Rules, Rates, Minimum Stays
- Conversations, Messages, Auto-Responses, Templates
- Reviews, Tasks, Expenses, Webhooks
The Hostaway Integration Challenge
Property managers run their entire short-term rental operation on Hostaway, but building reliable automation on top of it is non-trivial:
- API key gated in settings: Each account's Secret API Key lives under Settings → Integrations → API and must be provisioned per account before any automation can run
- OAuth token lifecycle: Access tokens must be requested, cached, and refreshed; mishandling expiry silently breaks long-running syncs
- Channel data variability: Listings, rates, and reservations carry channel-specific fields and mappings from Airbnb, Vrbo, Booking.com, and Expedia that must be reconciled into one model
- Custom and shifting rate limits: Hostaway applies custom rate limits, so naive polling of reservations and calendar data hits throttling at scale
- Webhook plumbing: Reservation, message, and listing events arrive via webhooks that need verification, retries, and dedup to stay consistent with the API
- Pagination at volume: Large reservation and message datasets require cursor-based pagination (afterId) and careful sorting to avoid gaps and duplicates
How Supergood Creates Hostaway APIs
Supergood wraps Hostaway's REST API and authenticated surfaces in a resilient, normalized API layer for your account—so you integrate once across listings, reservations, calendar, messaging, and reviews instead of stitching together channel-specific quirks.
- Handles API key and OAuth token issuance, caching, and refresh securely
- Manages custom rate limits with adaptive throttling, backoff, and cursor-based pagination
- Normalizes responses across Listings, Reservations, Calendar, Conversations, and Reviews so you build against consistent objects
- Ingests Hostaway webhooks with verification, retries, and deduplication to keep your data in sync
Use Hostaway with AI agents: Hostaway MCP Server →
Getting Started
- Schedule Integration Assessment
Book a 30-minute session to confirm your listings, connected channels, and authentication model.
- Supergood Generates and Validates Your API
We deliver a production-ready Hostaway API tailored to your account, channels, and entitlements.
- Deploy with Monitoring
Go live with continuous monitoring and automatic adaptation as Hostaway evolves.
API Endpoints
Authentication
/authenticateExchange your Hostaway account ID and Secret API Key for an OAuth access token used on downstream calls.
Listings
/listingsList properties with amenities, photos, channel mappings, and custom fields, filtered by status and channel.
Reservations
/reservationsRetrieve reservations with cursor-based pagination (afterId) and sorting by arrival, departure, or last-modified time.
Reservations
/create_reservationCreate a new reservation against a listing with guest, dates, channel, and pricing details.
Calendar
/calendarPull availability, rates, and minimum-stay rules for a listing across a date range.
Messaging
/send_messageSend a guest message into an existing conversation thread synced across the connected channel.
Use Cases
Sync listings, rates, and availability across channels
- Pull listings, amenities, and channel mappings into a central catalog - Push rate and minimum-stay changes to calendar so availability stays consistent - Reconcile channel-specific fields from Airbnb, Vrbo, Booking.com, and Expedia into one model
Automate reservation and guest workflows
- Stream new and modified reservations into your PMS, CRM, or data warehouse - Create and update reservations programmatically without portal clicks - Trigger check-in, cleaning, and smart-lock automations on booking events
Centralize guest messaging and reviews
- Pull unified conversations and messages across every connected channel - Send automated guest responses and templates into the right thread - Sync reviews and ratings into reputation and analytics tools
Power revenue management and reporting
- Feed reservations, rates, and occupancy into pricing and BI engines - Sync expenses and financial data into accounting systems - Surface occupancy, ADR, and RevPAR metrics for portfolio reporting
Technical Specifications
Authentication
Hostaway account ID plus Secret API Key exchanged for OAuth access tokens, managed in a secure session
Connectivity
Hostaway REST API surfaced through a normalized Supergood layer, with webhook ingestion
Response format
Normalized JSON across Listings, Reservations, Calendar, Conversations, and Reviews objects
Rate limits
Adaptive throttling tuned to Hostaway's custom per-account rate limits to avoid 429s at scale
Session management
Automatic OAuth token caching, refresh, and credential rotation
Data freshness
Near real-time updates via webhooks for reservations and messages, with scheduled syncs for listings and calendar
Security
Encrypted credential vault, scoped access tokens, SOC 2-aligned controls, and audit logging
Webhooks
Verified, deduplicated ingestion of reservation, message, and listing change events
Latency
Sub-second reads on cached listing and calendar data; multi-second writes when posting reservations and messages
Throughput
Horizontally scaled workers sized to multi-property, multi-channel reservation volume
Reliability
Retry, backoff, and idempotency keys for reservation and rate writes; cursor-based pagination for large pulls
Adaptation
Continuous monitoring of Hostaway public API releases and channel-mapping changes
Frequently asked questions
Yes. Hostaway offers a documented REST API with a sandbox, accessed via a Secret API Key under Settings → Integrations → API and OAuth tokens. Supergood wraps it in a normalized, resilient layer so you integrate once across listings, reservations, calendar, messaging, and reviews.
The API spans listings, reservations, calendar availability and rates, guests, conversations and messages, reviews, tasks, and expenses—reconciling channel-specific data from Airbnb, Vrbo, Booking.com, Expedia, and other connected OTAs into a single model.
Supergood applies adaptive throttling, backoff, and cursor-based pagination (afterId) tuned to your account's custom rate limits, so large reservation and message pulls stay within Hostaway's thresholds without dropping data.
Yes. Supergood ingests Hostaway webhooks for reservation, message, and listing changes with verification, retries, and deduplication, keeping your downstream systems in sync in near real time.
Supergood securely stores your account ID and Secret API Key, requests and caches OAuth access tokens, and refreshes them automatically before expiry so long-running syncs never silently break.