Core concepts
Scopes
What each scope grants, the pull and push presets, and the mapping.read trap.
Named <resource>.<action> and checked per route, so an endpoint your key
cannot use is unreachable rather than conditionally guarded. Scope strings are
permanent — they are stored on keys already issued and are never renamed.
Pull side (Staylah is the supplier, you are the client)#
| Scope | Grants |
|---|---|
ari.read | Read availability, rates and restrictions for your mapped properties |
content.read | Read static property/room/rate-plan content and the mapping list |
booking.quote | Price a specific stay and optionally hold it |
booking.write | Create a reservation against Staylah inventory |
booking.cancel | Cancel or modify a reservation you created |
booking.read | Retrieve the current state of a reservation |
Push side (you are the supplier or channel manager)#
| Scope | Grants |
|---|---|
ari.write | Upsert rates and inventory for mapped properties |
restriction.write | Upsert restrictions — MLOS, CTA/CTD, stop-sell |
reservation.write | Deliver a reservation you have already confirmed elsewhere |
reservation.cancel | Deliver a cancellation of a delivered reservation |
mapping.read | Reserved. Gates no endpoint today — see the note below |
mapping.readdoes not open/mapping/hotels. Both mapping endpoints requirecontent.read, on the pull side.mapping.readis issued with the push preset for a future partner-code read-back that is not built yet, and it currently grants nothing. A push partner that needs to see its own mapping — and step 3 of the integration checklist says every partner should — must be issuedcontent.readin addition to the push preset. Ask Staylah for it; it is not in the preset.
Presets#
- Pull partner (an agent buying from us, e.g. Dida):
ari.read,content.read,booking.quote,booking.write,booking.cancel,booking.read - Push partner (a channel manager, e.g. HPN/TAN):
ari.write,restriction.write,reservation.write,reservation.cancel,mapping.read— addcontent.readif the partner needs/mapping/hotels, which the preset alone does not reach
Where an endpoint lists two scopes, both are required — POST /bookings
needs booking.write and booking.quote, because creating a booking has to
price the stay to validate your amount, and a key that could book but not quote
would only half-work.