Track changes to the OutReserve developer API.

Activity discovery and detail can now return approved host-created experiences with
provider: outreserve. They use the existing UUIDs, canonical paths and image payload
shape, including host-uploaded cover photos. Private drafts and pending submissions
are excluded from partner/mobile APIs and MCP. Native activity capabilities keep
departures, price_preview, booking_request and booking false; clients must
continue using the per-listing capability flags. Hosting creation and review remain
authenticated web workflows; no partner/mobile write endpoints are added.

• Additive: Stay search cards (GET /api/v1/search and /api/v1/stays/search), property detail (/api/v1/stays/properties/:uuid), and country inventory now expose canonical OutReserve url and UTC updated_at fields. Unroutable properties have a null/omitted URL; standalone host cards link to their canonical accommodation page.
• Additive: GET /api/v1/countries/:country_id/properties accepts inclusive RFC 3339 updated_since filtering and returns meta.sync_started_at for incremental refreshes. It returns active inventory, without tombstones.
• Additive: partner search endpoints accept radius_unit=mi|km; miles and the 90-mile default remain unchanged. Explicit invalid units/radii now return machine-readable HTTP 422 errors. Existing valid numeric requests need no migration; response distance fields remain in miles.
• Discovery metadata and sandbox examples reflect the additions. See developer guide for pagination, cache retention, link availability, and conversion examples.

GET /api/v1/capabilities and /.well-known/api-catalog include an additional
endpoint capability descriptor. Existing partner request/response contracts and
API-key permissions are unchanged; no migration is required.

Released: 2026-10-31

Additive: GET /api/v1/activities/{uuid} includes an optional map object with
latitude, longitude, approximate: true, preview_url and external_url.
Map coordinates are rounded to two decimal places and describe an area, not a
verified meeting point. preview_url is null until a cached map exists; absent or
invalid coordinates produce map: null. Search responses do not add per-card map
lookups. Public image URLs are deduplicated, restricted to valid HTTPS URLs without
embedded credentials, and capped at 20. Image dimensions remain null when unknown.
Source-currency group prices and booking capabilities are unchanged. No migration
is required.

Released: 2026-10-30

Additive: GET /api/v1/activities and GET /api/v1/search?vertical=activities
share indexed discovery with optional categories[], providers[], lat, lng,
radius, min_price, max_price, display_currency and sort filters. Existing
query, location, scalar category, guests, region IDs and pagination remain
supported. Sort values are relevance, price_asc, price_desc, distance_asc,
distance_desc and newest. Radius defaults to 90 miles and is capped at 500 miles.
Price filters compare indicative group prices in a supported display currency;
response pricing retains the supplier currency. Guest filtering uses configured
capacity, not remaining seats. No availability, payment or booking-readiness flags
change. No client migration is required.

Released: 2026-10-30

Additive: activity capability payloads now advertise favorite: true. This capability
uses authenticated first-party account workflows and does not grant partner API keys
permission to save favorites. Activity prices, UUIDs and booking readiness flags are
unchanged; no client migration is required.

Released: 2026-10-30

Activity discovery, detail and HTML sitemap data now respect editorial hide/delete
state independently of provider publication. Hidden or deleted listings disappear
from public inventory; their detail endpoints return 404. Source refreshes preserve
these choices and stable listing UUIDs/slugs. Additive capability metadata exposes
unpaid_request_cancellation; supplier cancellation and live payments remain
unavailable. No client migration is required.

Released: 2026-10-26

Additive: activity capabilities and source-price previews now expose
collection_policy: "mirror_supplier". Previews also include payment_schedule
with source-currency integer-cent total, deposit due now, remaining balance,
balance_due_at: null and payable: false. The split follows the provider's exact
amounts, rather than a fixed deposit percentage. Missing or invalid policy/amounts
produce a null schedule. Existing source-price fields are unchanged. A balance
deadline is not inferred, and live payment remains disabled. No client migration is
required; consumers must continue to check booking and payment readiness flags.

Released: 2026-10-25

Additive: GET /api/v1/activities and GET /api/v1/activities/{uuid} expose
provider-backed activity cards and details with stable UUIDs, source-currency group
prices, category and location metadata. /api/v1/search?vertical=activities uses
the same discovery contract. The API catalog and capabilities advertise the new
dedicated endpoints. Prices are indicative and guest limits are configured capacity;
live availability guarantees and payable quotes/direct booking remain disabled
until browser/VCC supplier checkout is certified. GuideTime listings additionally
support GET /api/v1/activities/{uuid}/departures and
POST /api/v1/activities/{uuid}/price-preview with an opaque departure token and
integer guests. Tokens expire after fifteen minutes. Previews return integer-cent
base/fee/tax/total, deposit and balance, with availability_verified: false,
booking_confirmed: false, payment_collected: false, and Cache-Control: no-store.
A successful preview does not hold seats. Inspect provider-specific capabilities;
other providers do not automatically gain planning support. The deterministic
sandbox catalog now accepts vertical=activities without calling a real provider. Existing Stays/RV favorites, saved-trip and hosting
contracts are unchanged; no migration is required. See product verticals.

• New web/mobile stay reviews and successful mobile edits require admin approval. Create/update responses expose moderation.status: "pending"; public review endpoints exclude pending submissions. Authors retain access through /api/v1/mobile/me/reviews. See Mobile Stay reviews.

Availability: Private preview; no production booking activation or public toolkit publication.

• Added an API/Postman acceptance runbook for pending property creation, physical and pooled units, operator approval, default and dated prices, absolute inventory, property/unit closures, exact retries, validation problems, and audit evidence. The guide is included in the offline toolkit and allowlisted developer documentation routes.
• Destination pricing summaries exclude suspended Supply partners without falling back to legacy unit prices. CSV gallery imports and delayed media downloads now recheck current Supply ownership under the adoption lock boundary; queued legacy imports cannot amend a property after Supply approval. Gallery download jobs are published after the media transaction commits.
• No endpoint, error-code, reservation-activation, or publication gate changes are introduced by these corrections.
• Overnight local demand uses checkout-exclusive overlap for hold quotas, confirmed commitments, and amendment holds; genuinely overlapping stays still count, and day-use boundaries remain inclusive.
• Activated Supply checkout now freezes and verifies pricing in the transaction that reserves inventory; a mismatched quote rolls back the hold. Mobile checkout records its source IP for the same per-IP hold quota as web. Shared checkout validation accepts an inclusive single-date day-use stay, but not a zero-night overnight stay. Every Supply controller now has routing coverage, including the absence of destructive property, unit, and media routes.
• The pricing snapshot uses the inventory guard's current locked calendar rows rather than an earlier MySQL repeatable-read view. Day-use amendments retain the inclusive date convention, and Supply Workbench routing coverage includes reconciliation, credential lifecycle, and reviewed reactivation.
• Public Supply pricing sources are batch-loaded for unit collections and scoped to presentation only; dated quotes and locked checkout admission continue to use fresh canonical reads. Missing or inconsistent accepted pricing now redirects checkout to a controlled unavailable-pricing state before payment setup or rendering, without reconstructing money from live rates.

Availability: Branch-local preview; no production activation or partner certification is implied.

• Existing-property association now points 422 invalid_external_property_id to /connection_request/external_property_id, matching the submitted object. The error registry includes that pointer root. Property creation keeps /property/external_property_id.
• The uncertified reservation feed rejects after_sequence above 9,007,199,254,740,991 with 422 invalid_reservation_cursor at /after_sequence before ahead-of-feed handling. In-range cursors ahead of the published stream still return 409 reservation_cursor_ahead with exact numeric recovery context.
• Checkout-local and installed Supply documentation now link to the exact-cased Postman and example files, and the hosted developer guide serves those same paths. The offline toolkit checks internal Markdown links during its test run.
• A queued AI media analysis no longer changes partner-owned alt text or featured-image choice after Supply approval; an unapproved pending adoption remains legacy-managed. This is a local ownership guard, not certification of every legacy writer.
• The second queued image-analysis job and bulk OpenAI maintenance tasks now use that same current-state media guard. Bulk AI amenity, activity, and operating-time enrichment also checks Supply property ownership at its final write; a pending, unapproved adoption remains eligible for legacy enrichment.
• The manual KOA import now treats an existing Supply-owned listing as a protected write boundary across property metadata, seasons, closures, amenities, and media. It skips an approved adoption instead of replacing its content; a pending adoption remains with the legacy source until review.
• Google Places photo jobs now skip an already Supply-owned listing and recheck ownership under the property lock before saving an image downloaded while approval was in progress.
• First reservation activation and resume now require the same bounded, non-personal certification case identifiers as later unit publication; unsafe values cannot enter the property evidence. The reservation transition audit retains safe activation proof and a validated suspension case reference instead of dropping both.
• Persisted reservation activation now requires all six safe certification references and an integral certified horizon. Model validation and booking-readiness checks reject sparse, unsafe, or malformed evidence, including records written by direct SQL; a general case reference alone cannot open sales.

Availability: Branch-local implementation preview only. Reservation activation and partner certification remain separate release gates.

• New active Supply bookings now require an explicit total-person guests_count from 1 through the unit's max_occupants. Mobile quotes bind that value to booking creation; web instant and request checkouts collect it; accepted amendments freeze and recheck it before applying a paid change. Reservation snapshots expose the count separately from inventory quantity: 1. Unknown historical party sizes remain null rather than being fabricated, and missing or over-capacity counts fail closed. The reservation deployment gate remains off by default; existing non-Supply booking contracts are unchanged.
• Partner PATCH of a unit's max_occupants now rejects changes that would invalidate an open booking with 409 reservation_guest_capacity_conflict at /unit/max_occupants; an active reservation unit cannot clear its guest capacity (409 reservation_unit_occupancy_unavailable). Final booking and amendment guards recheck the current locked capacity. Cancellation and exact event replay retain the frozen accepted party size even if capacity later changes. Existing partners need no request migration; correct the conflicting booking or keep the higher capacity before retrying a reduction.
• A pooled Unit capacity reduction now checks overlapping open OutReserve stays in addition to reported daily ARI; a conflicting cut returns 409 reservation_pool_capacity_conflict at /unit/capacity. Capacity reviews use current non-waiting booking reads, returning retryable 503 reservation_capacity_review_busy if a booking is concurrently locked; more than 10,000 open bookings require supervised review (409 reservation_pool_capacity_review_limit). Expired pending checkout holds do not permanently block a reduction.
• The branch-local Node, Python, and cURL reservation polling examples now retain the non-personal guests_count field while still redacting guest/contact identity and future private fields. They remain manual protocol examples, not a durable PMS receiver.
• Public Supply teaser pricing now stops using a partner's default when that partner is suspended, even if its property mapping and connection remain approved. UCP catalog search, lookup, and detail omit a variant whose canonical rate disappears after initial selection instead of returning an HTTP 500 or substituting a different variant for an exact ID. Batch stay availability keeps a formerly approved adoption closed after revocation, matching checkout. No partner request shape changes.
• Property, unit, and media create/update requests now reject an array or object in a scalar field with 422 invalid_field_type and an exact field pointer instead of silently omitting that field. A supplied immutable unit identifier remains a 409 immutable_field even when its JSON value is malformed. This is a validation behavior correction; clients should send the documented primitive types and need no migration.
• The uncertified reservation preview also preserves supplied JSON types in acknowledgement validation: an array/object optional partner revision now returns 422 invalid_partner_revision without advancing the applied cursor. Existing scalar acknowledgement clients need no migration.
• A pooled unit's capacity reduction now compares accepted inventory only on today and future dates in the property's time zone. Historical calendar counts remain retained for audit but no longer cause a permanent 409 inventory_exceeds_capacity; current or future conflicting counts still require an ARI correction first. This is a behavior correction with no client migration.
• The separately labelled, uncertified reservation preview OpenAPI and manual Postman collection are now downloadable from the Supply developer guide. Node, Python, and cURL preview examples cover read-only polling, explicitly confirmed acknowledgements or semantic rejection, and ARI readback; they are not PMS adapters or live-booking authorization.
• A later reservation revision's applied acknowledgement must retain the preceding revision's partner reservation ID. A mismatch now returns 409 reservation_partner_identity_mismatch at /ack/partner_reservation_id without advancing the applied cursor; exact retries and property-local ordering remain intact.
• Supply booking-confirmation email and accepted-amendment checkout pricing now use validated frozen prices instead of mutable live rates. An incomplete required amendment snapshot fails closed, and the amendment sidebar counts inclusive day-use dates consistently with booking pricing.

Availability: Implementation preview. Production activation and partner credential issuance require a separate release and OutReserve approval.

• Added a dedicated /api/v1/supply contract for approved PMS and reservation-system connections to stage properties, create physical or pooled units, and apply absolute availability, rates, and inventory (ARI).
• Added a read-only canonical property-amenity catalog and strict property.amenity_ids effective-set replacement on new or approved content-owned Supply listings. Mixed invalid IDs fail atomically with indexed problem pointers; structured-value amenities are advertised but not writable in v1. Association changes retain per-join, request-linked audit evidence and Supply provenance even when an omitted materialized join is removed. No Property or Amenity record and no partner DELETE endpoint is introduced; production DDL and adopted-listing certification remain release gates.
• Added a guarded Node content-maintenance example for property, unit, and media patches, asynchronous media status, audited request lookup, and status-only deactivation. Its database-free protocol tests now run in the JavaScript CI gate; this does not imply a public sandbox or live partner certification.
• ARI writes use bounded atomic batches, a property calendar revision (If-Match), and Idempotency-Key; readback exposes the applied revision and effective sellability. Missing inventory remains closed.
• Supply-owned pricing uses only partner-authored dated or default rates. Adopting a legacy unit does not silently reuse its existing OutReserve rate; missing source pricing remains closed and blocks reservation activation.
• Primary undated public price displays now use an approved Supply unit/property default rather than stale legacy Unit or cached property prices. Dated-only partner rates show no undated teaser; a selected stay with an incomplete date schedule does not fall back to a different default. Supply-priced Stay pages and unit-row fragments bypass long-lived cache layers until ARI-aware invalidation exists.
• Stay property site-type summaries now derive their counts and undated prices from visible units and approved Supply defaults. Dated-only rates show counts without a price, and changes to partner defaults produce a fresh summary fragment.
• Destination stay-price rollups now exclude adopted Units' legacy rates and include only approved Supply defaults; mixed source currencies suppress aggregate prices. Public destination readers hide pre-refresh persisted price stats until the versioned canonical rollup replaces them, while preserving inventory counts.
• Mobile availability and quote unit summaries, web search JSON, and Meta/AvantLink product feeds now use approved Supply defaults rather than legacy unit or indexed prices. Guest amendment options use the selected stay's dated rate schedule. UCP catalog search, lookup, and product detail now require an active reviewed Supply outlet and canonical partner default; price filters and pagination no longer use adopted units' legacy rates. Date-specific sellability, deployed search-index verification, and portfolio-load certification remain open.
• Changes to Supply rate ownership, unit/property defaults, property approval, and account approval now enqueue the existing debounced Property search reindex path, so undated price filters can converge on the canonical partner default. Dated-only ARI rates do not change that undated indexed value; deployed queue-loss and Elasticsearch filter/sort verification remain open.
• Home and API discovery property-type averages now aggregate only positive legacy rates for non-Supply units and approved partner defaults for Supply units. When active Supply inventory contributes to home discovery, the 24-hour grouped-rate cache is bypassed and the home/API response is not shared-cached; API metadata advertises a zero price-cache TTL. Revision-aware invalidation and load benchmarking remain release work.
• The preview's calendar revision is carried in JSON, not encoded as an HTTP ETag; effective sellability can change without an ARI write. Activated-property readback now subtracts pending OutReserve demand and holds and reports freshness/feed closures. Unit metadata edits retain the existing stop-sell state, while explicit deactivation closes the unit.
• A partner-deleted media record is a terminal, auditable tombstone: GET still returns it, collection reads omit it, and PATCH status: active returns 422 invalid_status_transition at /media/status. Recovery is a new idempotent media import with a new UUID and operation; it never resurrects an old blob or in-flight import.
• ARI rechecks current connection, partner, credential validity, and supply:write scope under the property-link transaction lock. A concurrent account suspension committed after initial HTTP authentication now rejects the write as 403 connection_suspended without changing calendar rows or revision. Operator credential issuance, rotation, and revocation use the same account-first lock order; a revocation committed first rejects the stale authenticated write as 401 invalid_api_key.
• Unit inventory writes now require incorporated_reservation_sequence with each absolute count. It is bounded by the property's applied reservation cursor (using connection-wide event sequence numbers), cannot regress per unit/date, and is persisted atomically with the count and revision. Each explicit count snapshot refreshes inventory_received_at, even if the count is unchanged; rate-only writes do not.
• Concurrent unit-capacity changes and ARI count writes now validate against the current locked database state. If a new count exceeds the reduced capacity, the ARI request returns 422 inventory_exceeds_capacity; if a reduction conflicts with an accepted count, the unit update returns 409 inventory_exceeds_capacity. Neither path leaves a count above capacity.
• Two-session tests now force both ARI/capacity orderings at the shared property-link lock and verify the exact accepted/rejected outcome and stored revision, count, and capacity. ARI-first and reservation-publication-first tests preserve unincorporated booking demand. ARI-first versus acknowledgement returns 409 reservation_watermark_ahead; acknowledgement-first permits the same source snapshot. A booking/deactivation race exposed a stale Property snapshot under MySQL repeatable-read; final hold and amendment checks now use the current locked Property, so deactivation-first blocks a new hold. Payment webhook and guest cancellation are tested in both booking-lock orders: cancellation-first triggers captured-payment reconciliation; payment-first publishes new/cancelled revisions and one policy refund. A duplicate webhook during the post-commit refund gap now sees the exact already-applied payment ledger and cannot start a second full-capture refund.
• Final Supply hold and amendment checks now lock current connection and partner status after the property link, before property and unit state. A two-session test showed that an older MySQL snapshot could otherwise admit a booking after account suspension; suspension-first now refuses it, while an in-flight booking holding the account lock completes before suspension takes effect.
• First reservation-event publication also rechecks the current locked connection, partner, and property after the property-link lock, before consuming a stream sequence. Forced MySQL stale-snapshot tests reject new publication after a committed connection, partner, or property hold; no event or sequence is created. This does not replace full payment/cutover certification.
• Reservation acknowledgement now keeps the current locked property cursor and predecessor even when an older transaction snapshot predates the preceding acknowledgement. Supervised requeue rechecks locked account/partner state before replay. A lifecycle regression covers signed create, move, and cancellation demand across partial daily inventory watermarks, with ARI readback and checkout-guard parity.
• Added a read-only supply:verify_reservation_stream cutover task and operator runbook to compare the dedicated counter, contiguous immutable events, the former connection cursor, and property publication/application cursors before the reservation gate can be considered. It does not prove old process drain or live partner delivery.
• Unit-scoped Supply calendar rows now retain a checked Unit foreign key, so direct SQL deletion cannot orphan historical ARI. Supply-linked Property destruction aborts before dependent cleanup; direct SQL deletion is also blocked by the retained property-link foreign key.
• Composite calendar-to-Unit and calendar-to-property-link foreign keys now retain Property and connection identity: direct SQL cannot move a Unit or mapping with historical ARI into another Property or connection, nor reassign a calendar row to another connection. Normal Unit reassignment into or out of Supply management is blocked even before a calendar row exists. The required index on the existing Units table and the composite foreign keys need an online production migration review before release.
• Legacy dashboard property content/status, PMS takeover, listing-session, media, and season writes are now blocked for Supply-managed properties; OutReserve-owned commission and cancellation-policy settings remain editable. Admin bulk status changes abort atomically when any selected property has a Supply link, and legacy property merges reject a linked keeper or victim before direct SQL moves any Units, bookings, or media. Generic PMS property import and Campspot bulk reconciliation now refuse staged or ever-approved Supply listings before identity, content, or Unit write-through, including an import transaction whose snapshot predates the Supply link. Generic PMS details/units/media/rules/availability sync, single/batch and geocoding jobs, Newbook OTA, connection setup and provider-state cleanup, and ParkWithUs/Recreation.gov live availability now check current Supply ownership under the Property lock before legacy writes. Newbook OTA returns a terminal 409 SOAP conflict for a protected listing. A conflicting Campspot batch fails closed and needs operator triage; remaining maintenance writers and deployed cutover are still under audit.
• CSV property import now skips staged or previously approved Supply listings, including its bulk content, association, season, and media writers. Committed two-session tests force amenity/activity and header-image writes to finish before concurrent Supply approval. The header-image path holds the ownership lock through attachment commit and keeps its download stream open until that commit; external storage itself is not transactional, and a future outer transaction around the whole import would need separate stream-lifetime handling. Reviewed enrichment apply/rollback now conflicts on partner-owned targets while keeping OutReserve-derived summaries and cancellation policy editable; health and email validation metadata use validated Property writes.
• Legacy PMS sync jobs and live Newbook, ParkWithUs, Recreation.gov, and Channex ARI ingestion now refuse Supply-owned properties at a current ownership boundary. A delayed Channex event retains a failed event and existing 422 processor response without changing rates, blocks, or stay rules; a committed stale-snapshot test covers that cutover ordering. Provider retry behavior and the remaining evidence/maintenance writers still require certification and audit.
• Four legacy media purge/cleanup tasks, Recreation.gov's direct-SQL maintenance and import/version writers, and Channex certification/import entry points now check current Supply ownership before mutating a listing. The Recreation.gov maintenance dry run no longer writes. Filename-based Google media cleanup conservatively skips a Supply-linked listing because the filename cannot establish provenance. Adopted property links now retain the former (pms, external_id) as non-authorizing provenance; an OutReserve-side validated PMS cutover retains that key on the Property, and a generated unique index rejects duplicate legacy keys even from bulk SQL inserts. Existing cutovers with a missing old key, direct-SQL cutovers that bypass the retention callback, and production online DDL still need explicit review. Legacy Channex backfill evidence must not count as Supply certification.
• The Supply Workbench now has an operator-only legacy PMS cutover action requiring typed Property UUID, ownership proof, and bounded shutdown/mapping/booking-reconciliation case references. In one transaction it verifies current provider identity, refuses future booking obligations and ambiguous stock, stages the Property and Units as non-bookable, audits the actor and proof, and approves the Supply link without activating reservations. Legacy booking creation shares its lock boundary so booking-first blocks cutover and cutover-first blocks the booking. Existing booking migration, broader inventory mapping, production DDL review, and live cutover certification remain open.
• Preview reservation publication now rejects corrupt, negative, missing, or subunit-imprecise locked nightly rates with reservation_nightly_rates_missing before allocating an event sequence. The reservation financial and privacy contract remains uncertified.
• Added a checkout-local first-client certification harness that uses public Supply credentials and HTTP to rehearse idempotent onboarding, full-horizon ARI, readback, error probes, activation checkpoints, and reservation-feed reconciliation. It does not auto-acknowledge bookings or activate an outlet; a durable-PMS-evidence acknowledgement is an explicit operator-assisted probe. No sandbox or live PMS run is implied.
• Added read-scoped GET /api/v1/supply/locations for country, state, and destination identifiers, including locations without consumer listings; exact unknown or ambiguous identifiers return distinct problem codes.
• Property/unit/media creation, existing-property association, and review submission require a connection-scoped Idempotency-Key. Exact method/path/body retries return the original response without creating a second resource or import; changed requests with the same key return 409 idempotency_key_reused. Every authenticated controller-handled attempt remains auditable; pre-controller throttles and invalid credentials have no partner-attributed Supply request row. A bounded five-minute recovery task re-enqueues committed media imports when queue publication or a worker claim is lost; exhausted operations expose media_enqueue_failed. If a worker uploaded the image before interruption, recovery verifies the stored object and commits the existing media, operation, and audit record without downloading it again.
• Same-key onboarding retries now read the canonical committed result and current property visibility after acquiring the key lock, including when the retry's database transaction began before the original request committed. Different new keys do not acquire absent-key gap locks merely to check replay state.
• Added scoped Supply Bearer authentication, structured application/problem+json errors, redacted request audit access, and a developer kit with OpenAPI, Postman, runnable examples, and an Agent Skill. Newly issued credentials default to content read/write scopes; reservation read/ack scopes require explicit operator selection. Existing credential scopes are not silently changed.
• Added a released-method error matrix to the public Supply developer kit, available as Markdown and JSON alongside the global error registry. It maps plausible code/status pairs to all 21 Phase 1 operations without claiming exhaustive runtime coverage. Shared payload and media-type guards are now declared on GET as well as write operations. The Postman ARI examples retain each request's original If-Match with its idempotency key across exact retries; readback no longer silently clears either intent.
• The checkout-local NPX toolkit now packages and verifies both endpoint error-matrix files; its package preview version advances to 1.0.0-preview.2 without changing the 1.0.0-preview.1 HTTP contract or publishing to npm.
• The local error-contract check now parses Supply emitters and verifies every literal code/status pair against the published registry, including preview reservation and Workbench paths. The separate Rack throttle path remains covered by its direct 429 request spec. This does not yet certify every endpoint-specific error combination or dynamic field pointer.
• Supply per-credential minute/hour/day throttles now identify the Bearer credential, ignoring an apikey query parameter that Supply authentication never accepts. A throttled Supply request returns 429 rate_limited with integer-seconds Retry-After, rate-limit headers, and a matching body/header request ID even if throttled before Rails assigns one; existing consumer API key behavior is unchanged.
• The preview Postman collection now includes every released OpenAPI method/path, including unit read/update and media list/update. A contract check fails if those endpoint catalogs diverge; this does not certify response examples or the reservation preview.
• Additive preview refinement: GET /api/v1/supply/connection now lets a valid reservation-only key inspect its own granted scopes, including while sales are suspended; content and ARI remain unavailable during suspension. stale_revision and reservation-cursor/watermark conflicts include documented numeric context recovery values without changing their existing code, status, or pointer.
• Supply connection, property, and unit booking_ready values now reflect the default-off reservation activation gate and reviewed outlet/unit state in the private preview; connection reservations reflects whether its gated feed is accessible. These state flags are not certification or date-specific availability guarantees.
• Generic Supply connections remain non-bookable in Phase 1. The branch-local reservation pull/ack preview uses one portfolio read feed with property-scoped in-order application, but remains behind a default-off activation gate and is excluded from the released OpenAPI/Postman contract pending certification.
• Reservation acknowledgement retries now compare the optional partner revision exactly. Omitting it and supplying an empty string are different outcomes; the latter returns 409 acknowledgement_conflict after the former was applied.
• The branch-local reservation pull feed now bounds a page to the sampled committed stream head and fails closed with 409 reservation_stream_gap if a connection-local sequence is missing, including at a page tail. The problem includes typed expected/head sequence values; clients must stop and reconcile rather than advancing over absent history. This is a local integrity safeguard, not deployed delivery certification.
• In the gated reservation preview, a semantic rejection now explicitly suspends only the affected property's new sales. A reviewed Workbench requeue of the same event requires remediation references; normal partner acknowledgement and separate reviewed reactivation are still required. The legacy PMS push retry action cannot reopen a Supply event.
• The Supply Workbench preview now shows each property's published/applied reservation cursors and a bounded, guest-free delivery timeline for recent events, rejections, reviewed requeues, and partner application. The same panels appear during one-time credential issuance without persisting the key. First-client recovery certification is still required.
• Dashboard amenity-suggestion approval now refuses staged or ever-approved Supply-managed property content at both the action and locked association-write boundary; bulk approval rolls back together on a cutover conflict. Amenity writes are not yet exposed in the partner property contract.
• A captured Supply booking or amendment whose Stripe amount/currency differs from the saved pricing expectation is now refunded through the idempotent Supply reconciliation path instead of leaving a failed webhook with captured funds. Replayed success events do not issue a second refund. A formerly approved adopted outlet remains under the Supply booking guard after revocation, so a late capture cannot silently become a non-Supply paid booking.
• Captured Supply refund attempts now create an immutable payment-intent incident before Stripe IO. The original refund reason and idempotency key survive retries; failed provider calls and local finalization errors remain visible in Supply Workbench, including unattributed incidents. A terminal Supply amendment releases its booking lock transaction before this incident/refund path. A bounded five-minute alert task is configured locally; deployed alert routing, supervised retries, and live recovery certification remain pending.
• Captured-payment replays now inspect Stripe's refund history before another refund POST. An exact succeeded provider refund can repair a missing OutReserve ledger; pending, mismatched, multiple, or incomplete history holds for manual review. A newly created pending refund is not marked locally refunded. This closes the indefinite-idempotency-key assumption but does not establish a monitored response SLA or live Stripe certification.
• The Supply Workbench preview adds a supervised incident reconciliation form for admins. A support case reference and typed PaymentIntent confirmation are required, and actor-linked booking audits bracket the guarded Stripe attempt. Deployment, alert routing, and live provider-failure certification remain pending.
• Paid Supply cancellations with a positive policy refund now commit a separate, immutable refund obligation with the booking cancellation. The first provider attempt is recorded before Stripe I/O; failed or abandoned attempts remain visible in Workbench and trigger a bounded five-minute alert task. A previously queued automatic retry is stopped for these obligations because an expired Stripe idempotency key cannot prove whether an earlier attempt succeeded. This preview provides no automatic policy-refund recovery or live response SLA; operators must reconcile Stripe and the local ledger before any further refund.
• New Supply policy-refund requests carry a stable obligation identifier in Stripe metadata. A pending or otherwise non-succeeded provider result no longer marks the booking locally refunded; the obligation remains for reconciliation. This is a local first-attempt safeguard, not yet a certified provider-history recovery workflow.
• The same cancellation transaction now freezes the policy refund, retained fee, and non-PII fee breakdown. The post-commit Stripe request and booking ledgers use those frozen values, avoiding a different amount if the cancellation window changes between commit and provider I/O.
• The Supply Workbench preview now offers an audited policy-refund recovery action. It requires a support case plus typed PaymentIntent and minor-unit amount, checks the complete Stripe refund page first, repairs a local ledger only from one exact succeeded metadata-tagged refund, and issues the frozen amount only after a separate opt-in when history is empty. Pending, mismatched, multiple, and incomplete histories stay in manual review without another POST. Live provider-failure drills and operator response SLA remain unverified.
• Supply policy-refund finalization now requires the provider response to match the frozen payment, amount, currency, and obligation identity. Booking refund flag and ledger writes use one savepoint: a failed local ledger insert cannot leave a refunded booking with no ledger, and the supervised history-first action can repair the exact settled provider refund. Committed MySQL tests cover both original-cancellation/operator-recovery orders without a second refund POST; live provider and process-death drills are still required.
• An administrator can manually erase the protected guest payload of an already acknowledged preview reservation event without removing non-personal history; feed pages crossing that event return 409 reservation_cursor_expired rather than silently skipping it. No automatic retention interval, backup erasure, or live guest-data release is implied.
• Existing read-only Developer API endpoints and their authentication behavior are unchanged; Supply endpoints require dedicated server-side credentials. No migration is required for existing clients.

• Private mobile listing edit data now includes operating_agreement document identifiers, URL, acceptance state and Connect readiness. The existing Stay review step accepts explicit, version-bound agreement assent; its retry fingerprint includes those fields.
• Publication and new marketplace bookings require current signed host consent. Instant Book additionally requires a verified, payout-ready Stripe Connect account; publication and Request to Book remain possible before Connect onboarding.
• New direct-host marketplace quotes apply 20% Stay or 18% Canadian RV commission to nightly rental charges only. Existing immutable quote and booking amounts remain unchanged.
• See operating agreements for acceptance fields and release review.

• Host profile capability metadata now uses the same raster-photo formats as web and account avatars: JPEG, PNG, GIF, WebP, AVIF, HEIC and HEIF. The existing 5 MB host avatar limit remains unchanged; SVG is not accepted for host/account avatars.

• With INVENTORY_UNIT_SEARCH_ENABLED=true, dated Stay searches on web, mobile and partner APIs apply local blocks, unexpired holds, paid reservations, seasons and booking-window/stay-length rules before counting, facet aggregation and grouped pagination. Overnight checkout is exclusive; expired holds no longer suppress available dates.
• Dated web result payloads are not shared-cache snapshots. Provider click-outs and inventory without locally authoritative availability remain discoverable, with availability still confirmed through their provider; search never reserves inventory. RV rental search remains separate and existing response fields are unchanged.
• Internal reservation contexts without published public Stay inventory are excluded from the accommodation projection. Successful reindexing invalidates cached result payloads after the refreshed documents are searchable. Rebuild previously populated accommodation indexes with the current projection before activating the controlled rollout.

Released: 2026-10-08

• Additive: the existing marketplace checkout descriptor in /api/v1/capabilities and /.well-known/api-catalog now advertises card_setup: true and bank_authentication: true. Existing endpoint identities and partner booking contracts are unchanged; consumers may ignore the additional capability flags. No partner client migration is required.

• Host calendar holds use the selected half-open date range and expire at midnight on the end date in the listing Property's timezone (application timezone fallback). Web and mobile no longer accept hold_hours; calendar responses replace that metadata with hold_expiration: end_date. Notes remain private to authorized portfolio members.

Released: 2026-10-08

• Additive: hosted accommodation cards (inventory_type: marketplace_listing) in Stay discovery now include booking_partner: individual_host and a location object with the listing's country, state and destination names. This is inventory geography, not the host's account location; exact addresses remain private. Existing card identity, routes and approximate coordinates are unchanged.

• Stay discovery can use a versioned accommodation index after backfill and activation. Filters then match a single Unit rather than mixing features across a Property. Professional results remain grouped by physical Property; published independent host listings use inventory_type: marketplace_listing, stable listing UUIDs, public host attribution, canonical links.web_path, approximate coordinates, and undated starting-nightly pricing. Clients should dispatch cards by inventory_type; professional Property card fields remain unchanged.
• /api/v1/stays/search and the Stay mode of /api/v1/search remain Stay-only. RV rental queries continue against their separate vehicle index; RV campsites are Stay inventory, not rental vehicles. Booking/availability services remain authoritative for dated prices and reservations.
• Controlled deployment: build the index before enabling INVENTORY_UNIT_SEARCH_ENABLED=true. Existing indexes are retained for rollback. Grouped result totals/facets use Elasticsearch cardinality and are estimates at high cardinality. The activated Stay endpoints additionally return meta.inventory_count, the raw matching inventory-document total (including explicit provider-summary documents), separately from the grouped card total_count.

Released: 2026-10-08

• Additive: Stay searches through /api/v1/search and /api/v1/stays/search accept booking_partner[]=campgrounds or booking_partner[]=individual_hosts. Selecting both, or omitting the filter, includes both inventory kinds. Unknown choices return no results rather than broadening the search.
• This distinguishes professional campground/RV-park inventory from standalone host-owned accommodations; it is independent of booking method and payment/provider identity. It does not filter the RV rental vertical. Existing search requests remain compatible.

Released: 2026-10-08

• Destination responses now include published host-owned accommodation units in Stay category counts and nightly pricing, and published Canadian peer RVs in RV rental counts, pricing and feature distributions. Draft, paused and suspended marketplace supply is excluded; RV reservation contexts are not accommodation sites.
• Additive counters: professional_properties_count, stay_units_count, p2p_stay_listings_count, p2p_rv_listings_count, stay_hosts_count, rv_hosts_count, and hosts_count. Host counts deduplicate owning Host Profiles across portfolios; no host identity or private profile data is exposed.
• Existing properties_count remains the count of public accommodation contexts (professional properties plus standalone published Stay contexts), not the number of units or hosts. Existing fields and endpoints remain compatible. New counters default to zero until the next scheduled statistics refresh. No client migration is required.

• Added authenticated POST /api/v1/mobile/host/phone_verification with phone_number to send a Twilio Verify code. Returns data.challenge, data.verified: false, and localized data.message.
• Submit the returned challenge and verification_code to PATCH /api/v1/mobile/host/phone_verification. A successful check returns data.verified: true and synchronizes account contact verification and Host Profile readiness. Challenges expire after ten minutes and are bound to the authenticated account and requested number.
• This flow does not create or switch accounts, change login phone identifiers, or opt users into marketing. Sends and checks are rate-limited; recoverable errors use host_phone_invalid, host_phone_code_invalid, host_phone_unavailable, and host_phone_rate_limited.

• Added authenticated first-party mobile endpoints to list assigned active properties, read editable property details, and update a limited set of fields (name, headline, and street_address). Only property owners/admins and platform administrators may save changes; unassigned properties are not disclosed.

• POST /api/v1/mobile/stays/quotes may include error.details.next_available_date with a suggested check-in date when the requested dates are unavailable and an equivalent stay can be verified from current local inventory or explicit provider availability.
• The suggestion preserves the requested stay length, is limited to the next 365 days and configured booking window, and is omitted when provider availability is unknown. It does not reserve inventory; availability is revalidated at checkout.

Released: 2026-09-17

• Behavior change: POST /api/v1/stays/availability_alerts rejects notify_sms: true with HTTP 422 and a message directing users to complete SMS setup in the signed-in web form. Previously this flag could be stored but did not send SMS.
• Partner API clients should omit notify_sms or send false; email and webhook delivery remain supported. SMS opt-in is currently available through the signed-in web form, which verifies the destination. The partner API does not expose that verification flow.
• Existing unverified SMS flags do not authorize delivery and are not automatically activated.

• Added the shared P2P marketplace resource model for globally drafted outdoor Stays and Canada-only RV rentals. Publishing and native booking fail closed unless a versioned market configuration, payout account, compliance evidence, identity state, and licensed protection adapter are ready.
• Added mobile Hosting and Travel resources for portfolios, listings, reservations, canonical conversations, messages, and RV handovers.
• Added first-party all-in marketplace quotes and idempotent Request to Book and Instant Book checkout with mandatory protection binding and manual payment capture.
• Added incident and claim intake with evidence controls and disputable payout holds, plus immediately published completed-trip reviews, responses, and reporting.
• Added audited marketplace listing reports on web and mobile, plus explicit per-conversation masked-SMS consent and quiet-hour preferences.
• Provider-imported RVs retain provider click-out checkout. Eligible outreserve_p2p RV records advertise native availability, quote, payment, protection, claim, and handover capabilities only in Canada.
• P2P Stay drafts can be started globally. Public booking availability is determined per exact market rather than by a global country flag.

• Public discovery and detail endpoints accept language=en|nl|de|es and measurement_system=auto|metric|imperial; unsupported values return HTTP 422.
• Omitting language preserves canonical text and existing response fixtures. Supplying it resolves allowlisted public text and adds per-field fallback metadata without translating private messages, internal notes, or provider payloads.
• Legacy numeric measurement fields remain unchanged. Localized responses add structured measurements containing the converted value, unit, and display string.
• GET /api/v1/capabilities advertises the supported language, measurement, and fallback contract.

• GET /api/v1/mobile/stays/properties/:uuid?representation=compact omits the duplicate active_units alias while retaining the complete units collection and all other fields, including authenticated favorite state. The default response is unchanged.
• Mobile Stay cards prefer an already-generated card-sized WebP/image, with original/map fallback. Requests do not create image variants.
• Mobile destination list/detail responses now support ETag / If-None-Match and return HTTP 304 for an unchanged representation. Responses use private, immediately revalidated caching, not shared edge caching. Clients must retain the previous body to handle 304.
• These changes do not cache availability, quotes, booking mutations, or authenticated reads in shared client/edge caches.

• Preferred-currency discovery prices now resolve through an effective-dated Frankfurter-backed rate ledger when a complete, fresh supported-currency matrix is available.
• Provider reference rates include a bounded conservative display uplift. The original owner-entered value remains available in the existing source_money object.
• Booking, amendment, payment, refund, and ledger money remains in the immutable booking currency; no API consumer should treat a discovery conversion as an executable FX quote.

• Pricing responses now include an explicit ISO currency and integer minor-unit fields. Mobile inventory cards expose canonical pricing.money and pricing.source_money objects; Stay quotes and bookings expose immutable line-item money objects plus compatibility major-unit fields.
• Stay property units now include display/source rate_money objects, rate_cents, and currency; dated availability includes nightly and stay-total display/source money objects.
• Mobile discovery, favorites, saved trips, Stay details, RV details, and RV comparisons honor an authenticated user's display-currency preference only when OutReserve has a configured rate for the pair.
• amount_cents remains the compatibility field name and represents the supplied currency's minor unit; clients must not assume every currency has two decimal places.
• Missing exchange rates no longer relabel an amount as a user's preferred currency. Responses retain the source amount and source currency until OutReserve has a configured rate.
• Effective-dated rates can now be curated internally without an external FX provider. Discovery payloads use the active direct or reciprocal rate while booking, Stripe, refund, and ledger amounts remain unchanged.

• Stay property unit payloads now expose booking_method, checkout_type, and click-out provider details so native clients can choose Instant Book, Request to Book, or an external provider action.
• Mobile Stay quote and booking endpoints now reject click-out units, and native Request to Book submissions use the same 48-hour request lifecycle and confirmation job as web checkout.

All notable changes to the Outdoor Stays REST API are documented here.
This changelog is intended for API consumers and partner developers.

• RV rental API availability is limited to Canadian peer-to-peer inventory. United States RV rentals are not available through the public API.

Added

• Added GET /api/v1/countries/:country_id/properties, a database-backed, paginated collection of every
  active Stay property in a country. It uses the detailed property representation and is not subject to
  Elasticsearch's 10,000-result window.

• Added destination-scoped search across Stay and RV rental inventory in GET /api/v1/stays/search,
  GET /api/v1/rv-rentals/search, GET /api/v1/search, and GET /api/v1/mobile/search.
  Supply destination or destination_id with
  destination_scope=assigned, boundary, or assigned_or_boundary to exclude inventory that is
  merely within the destination's nearby radius. Boundary results use exact stored-polygon containment;
  destinations without boundary data return a machine-readable destination_boundary_unavailable error.

• Added first-party mobile account/session APIs for email/password auth, token
  refresh/revocation, profile context, synchronized preferences, device
  registration, and account deletion.

• Added the complete mobile availability-alert lifecycle (GET|POST|PATCH|DELETE
/api/v1/mobile/availability-alerts) with ownership checks and live status.

• Added native destination discovery, destination-scoped Stay/RV search and
  filter metadata, unit-aware favorites, and mobile API capability catalog
  entries.

• Added verified-guest Stay review CRUD under /api/v1/mobile.

• Added mobile Stay availability, server-authoritative quotes, booking history,
  native Stripe PaymentIntent creation, saved payment-method setup, cancellation,
  and booking amendment endpoints. Stripe webhooks remain the payment source of
  truth.

• Added opaque saved payment-method list, SetupIntent, completion, update, and
  deletion routes under /api/v1/mobile/payment-methods.

• Added authenticated mobile privacy export (GET /api/v1/mobile/me/export) and
  support contact submission (POST /api/v1/mobile/support/contact) routes.

• Added RV rental API endpoints for Canadian peer-to-peer inventory:

  • GET /api/v1/rv-rentals/search
  • GET /api/v1/rv-rentals/listings/:uuid
  • GET /api/v1/countries/:country_id/states/:state_id/destinations/:destination_id/rv-rentals

• Added rv_rentals_count and rv_rentals_stats to Country, State, and Destination API responses.

• Added vertical=rv-rental support to GET /api/v1/search.

• Added mobile-ready planning endpoints and normalized cross-vertical inventory card payloads:

  • GET /api/v1/mobile/home
  • GET /api/v1/mobile/search
  • GET|POST|DELETE /api/v1/mobile/favorites
  • GET|POST|PATCH|DELETE /api/v1/mobile/saved-trips
  • POST|DELETE /api/v1/mobile/saved-trips/:saved_trip_uuid/items
  • POST /api/v1/mobile/external-provider-clicks
  • GET /api/v1/mobile/rv-rentals/compare

• Added API productization endpoints:

  • GET /api/v1/capabilities
  • GET /api/v1/sandbox/listings
  • GET /api/v1/webhooks/events
  • GET|POST|PATCH|DELETE /api/v1/webhooks/subscriptions

• Added REST endpoints to /.well-known/api-catalog, including endpoint-level capability flags.

• Added deterministic sandbox listings with stable UUIDs for Stay and RV Rental integration testing.

• Added webhook subscription registration for future RV listing-change and trip-event delivery.

Changed

• RV rental detail responses now include exterior_width from linked make/model dimensions when available.
• Mobile Stay inventory-card features now include the boolean closed_for_season field.
• Expanded GET /api/v1/mobile/search/filters with the complete per-vertical native filter vocabulary, including active Stay amenities and activities, RV-site surfaces and hookups, RV rental trip/vehicle options, rating thresholds, and supported sort values. Mobile search cards now expose matching filter-relevant feature metadata so clients can explain why a listing matches.
• API key request submissions now include a validated primary use case: stays or rv-rental.
• RV rental unsupported-market errors now include a stable code, vertical, and supported_countries metadata.
• RV rental search now supports trip-intent filters for delivery, drivable or towable RVs, pet-friendly vehicles, generator and hookup features, and delivery radius.
• Dated RV rental search responses now include a rental-only trip estimate, minimum-stay fit, and an explicit provider-confirmation status. Taxes, fees, and live availability remain provider-confirmed.
• RV comparison links use OutReserve listing UUIDs and preserve pickup date, return date, and guest count for shareable trip comparisons.

Availability

• RV rental API data is currently available for Canadian peer-to-peer inventory. United States RV rentals are not available through the public API; unsupported markets return 422 Unprocessable Content.

Released: 2026-04

Added

• The detailed Property endpoint (GET /api/v1/stays/properties/:uuid) now includes an alliances array.
  • Returns active top-level alliances the property belongs to (matching public website behavior).
  • Each alliance includes: name, slug, name_segment, and logo (public CDN URL when a logo is attached). id and the old logo_url key are omitted.
• Alliance logos now use the same public CDN URL format as other image fields in the API.

Changed

• Updated property response examples and coverage for the new alliances field.
• Alliance entries now include additive category values (association or brand) so clients can distinguish membership attribution from brand management.

Released: 2026-04

Changed

• Standardized V1 API response generation for GET /api/v1/stays/search and GET /api/v1/stays/properties/:uuid.
• Response shapes for the standardized endpoints are preserved for backward compatibility.
• API responses now use a single, consistent JSON envelope pattern across V1 endpoints.

Documentation

• Updated public API documentation to reflect the standardized response pattern.

Released: 2026-04

Changed

• Location endpoint responses for /countries, /states, and /destinations now use the standardized V1 JSON response pattern. Response shapes are unchanged.

Documentation

• Added detailed usage examples and response samples for the Country / State / Destination hierarchy in the public developer portal.
• Improved endpoint descriptions in the public API reference.
• Expanded public changelog coverage for location endpoints.

Released: 2026-02

Added

• Authentication: API key authentication via apikey query parameter or Authorization: Bearer header.
• Rate limiting: Per-key rate limits (minute / hourly / daily) enforced via Rack::Attack.
• Hostname restriction: Optional per-key hostname allowlist for partner integrations.

Endpoints

Common Parameters

Search Parameters (/api/v1/stays/search)

Response Envelope

All collection endpoints return:
json
{
"data": [...],
"meta": {
"page": 1,
"limit": 25,
"total_count": 100,
"total_pages": 4
}
}


Single resource endpoints return:
json
{
"data": { ... }
}


Error Responses

Security lifecycle hardening (2026-10-21)

• Successful password recovery revokes browser sessions and all OAuth access, refresh and authorization grants. Ordinary mobile logout remains device scoped.
• Mobile refresh rotation retains the original session issue time and stops after 90 days. Existing grants without a trustworthy original issue anchor require sign-in at their next refresh; current access tokens retain their normal expiry.
• Email-based OAuth account linking requires explicit verified ownership from Google or Apple. Existing provider-ID login and signed-in explicit linking remain.
• Removed or downgraded portfolio staff immediately lose host conversation read, send and notification access across browser, mobile and queued delivery paths.

2026-10-23 — First-party Stay review photos and optional stay details

Authenticated mobile users can submit a Stay review without an OutReserve booking.
Matching completed bookings continue to confer verification; self-reported sites do not.
One OutReserve review per account/property is shared with web submission. Existing bearer
authentication and idempotency behavior remain. Multipart creation/update accepts photos[]
(up to five JPEG/PNG/WebP files, 10 MB each) and optional stayed_on (ISO date, not in the future).
Reviews include stayed_on and a photos array of {url, thumbnail_url}. Empty galleries
serialize as []. Signed blob identifiers are not accepted as uploaded photos.

2026-10-23 — Mobile review management and gallery editing

• Completed first-party account review CRUD: PATCH supports partial edits without requiring a new rating or overwriting omitted fields. DELETE and account listing work for web- and mobile-created OutReserve reviews; imported reviews remain read-only.
• Multipart photos[] append while retaining existing photos. PATCH remove_photo_ids[] removes only identified attachments belonging to that review; invalid edits preserve the existing gallery. Photo responses add opaque id values and reviews add author-only permissions: {edit, delete}.
• Optional site changes validate property membership and recompute completed-booking verification. Rating parsing rejects malformed/fractional input. Create/edit/delete retry and ownership contracts are covered by request tests.
• See Mobile Stay reviews for endpoints, multipart fields, optional stay details, error codes and retry behavior. The discovery catalog now advertises account-authenticated writes, optional booking verification, photos and partial edits. The existing mobile reviews capability remains enabled; no new route families or association paths were added.