Managing endpoint access

Use the Endpoint access tab in the Machine Accounts page of the Provider Portal to restrict endpoint-specific access. Use this to directly control how each machine account is configured and the Connectivity API endpoints it can call.

To configure endpoint access, you need:

• A machine account with token-based authentication enabled.
• A connection from each property for the APIs you want to call.

Only admin users can change endpoint access for machine accounts. For more information on how to manage user access, see Managing your information on the Connectivity Hub.

Endpoint access is just one part of the authorization context for a Connectivity API request. Note that enabling an endpoint for a machine account does not automatically grant access to the endpoint for a linked property. It depends on the connection type with individual properties and fulfilling any certification requirement.

When you call a Booking.com API endpoint using an access token generated from the machine account credentials, the following access rules apply:

• The property referenced in the API request must be linked to the machine account. You manage property links using the Provider Portal under Machine Accounts. Endpoint access settings apply to all properties linked to a machine account.
• The provider must have accepted a connection from the property with the corresponding connection type for the API that is being called. For a list of connection types mapping to APIs and endpoints, see Mapping connection types with endpoints.
• The requested endpoint must be enabled for the machine account.
• The provider must have implemented and obtained any certifications required to implement the API solution. Most of the Connectivity APIs require self-certification. For example, Property API. Whereas, some API solutions that handle PII and PCI data might require providers to be PII and PCI compliant. For more information, see Introduction on PCI and PII compliance.
• The access token generated based on the machine account credentials hasn’t expired.

A connection type from a property defines the API capabilities a provider can use for a property. Endpoint access then lets you control which of those available capabilities a specific machine account can use. For more information on connection types and how they relate to access restrictions, see Managing your connections.

If you remove a connection type to a property or change it, the machine account loses access to endpoints that were previously available for that property.

When you create new machine accounts, the system assigns specific endpoints, by default. After creating a machine account, review its endpoint access before using it in production.

Using the Endpoint access tab, choose the API endpoints the machine account is allowed to call.

For each machine account, you can:

• Review the existing endpoints access settings
• Enable endpoints that the machine account needs
• Disable endpoints that the machine account should not use

During the Endpoint access launch, existing machine accounts carry forward the current access so current integrations continue to work. You can review and update the endpoint access for each machine account after launch.

If an endpoint is not available in the Provider Portal, contact Connectivity Support.

This section covers possible error responses related to endpoint access change and any proposed resolutions.

An API returns the following HTTP/1.1 403 response when the endpoint access fails:

Access denied: Request path <request path> not authorized

To resolve the error, perform the following checks:

• The endpoint is enabled for the machine account;
• The provider is certified for the API, when certification is required;
• The property has the correct connection type set up with your provider, when the API depends on a provider-property connection;
• The machine account belongs to the provider you are managing.

If these settings look correct and the request still returns 403, contact Connectivity Support with the RUID details from the response.

• Understanding the access scope using machine accounts.