Partner API

The Partner API gives property staff, hotel management systems, and partner integrations access to loyalty program configuration, the Action Center, member and reservation lookup, guest intelligence, and partner pages — all scoped to your organization.

Base URLCopy Anchor Link

Every partner route is served under /v1. The version is part of the path, so it is already included in the base URLs below.

Staging is the partner sandbox and is paired with the WorkOS staging environment, so staging credentials are separate from production credentials.

https://api-prd.cf.journey.com/v1/partner/fulfillments/search

AuthenticationCopy Anchor Link

Send your partner API key in the X-API-Key header:

X-API-Key: jny_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Operator-driven surfaces (an actual person signed in to HXP) authenticate with that operator's WorkOS access token instead:

Authorization: Bearer <workos-access-token>

Core resolves the organization, permissions and venue reach from the verified token. See Partner authentication for the full model, including what is live today and what is coming soon.

ScopesCopy Anchor Link

Each route requires one permission string. These are the real values the server checks — the earlier FULFILLMENTS.READ style names were internal constant names, not wire values.

ConventionsCopy Anchor Link

• IDs are external. Requests and responses use external ids (UUID v7, ULID or HMS external id). The two exceptions are memberId on GET /partner/windfall/members/:memberId and inviteId on the guest-invite routes, which are internal integers.
• Organization scope comes from your credential. A partner credential ignores ?organizationId=; only Journey staff with global scope may send it.
• 404 means "not found or not yours". The two cases are deliberately indistinguishable.
• Responses are additive-only. New fields appear over time; ignore fields you do not recognise.

ErrorsCopy Anchor Link

Every error uses the same shape:

{
  "type": "validation_error",
  "timestamp": "2026-10-09T18:22:41.218Z",
  "code": "ambiguous_credentials",
  "message": "Conflicting credentials were supplied.",
  "details": {
    "reason": "Authorization and X-API-Key carried different credentials."
  }
}

WebhooksCopy Anchor Link

There are no outbound partner webhooks today. Poll GET /partner/arrivals and GET /partner/fulfillments/pending for the Action Center feeds. See Partner webhooks for what is planned.

Core featuresCopy Anchor Link