What is a booking API, and what should an outfitter's booking platform expose?

Every booking API comes down to three verbs, plus cancel:

• Read: what's open for a date range, with the seats, slots or items left. It should come from the live count, never a copy.
• Hold: keep a place for a few minutes while the guest decides or pays. A hold counts against capacity and expires on its own.
• Book: confirm the hold, or book outright, with the guest's name and email. Cancel frees the place again.

A good API also tells a retry from a new booking. The client sends an idempotency key, a unique ID per booking, so a request repeated after a timeout returns the first booking instead of making a second. More on how double bookings are prevented.

Bookings don't only come from your own website. OTAs took 37% of operator bookings in 2025 (Arival, Jan 2026), and every channel that sells your trips needs the same live availability, or two of them sell the last seat.

AI assistants are next. As of October 2026, besides daybag, only four booking platforms used by outdoor operators give an AI agent an official way to book: Bókun, TicketingHub, EquipDash and Twice Commerce.

A webhook is a message the platform sends to your URL when something changes: a booking confirmed, a booking cancelled, a session added. Your guide sheet, CRM or accounting tool hears about it in seconds, without asking over and over.

Webhooks should be signed, so the receiver can check that each one really came from the platform.

An OpenAPI document describes every endpoint, input and response in one JSON file. Developers generate clients from it and test against it, and AI tools read it to learn the API. It belongs at a public address.

The Model Context Protocol (MCP) is an open standard for connecting AI assistants to tools. A booking platform's MCP server offers its actions as tools, so an assistant such as Claude or ChatGPT can check availability, hold a place and book, with the outfitter's permission. More on how AI assistants book.

daybag is built API-first. Offerings, sessions, bookings, customers and webhooks are all operations on its REST API, and every operation is also an MCP tool.

• Read: GET /offerings/{id}/availability returns what's open for an offering.
• Hold and book: POST /bookings books, or holds with hold_minutes. POST /bookings/{id}/confirm confirms a hold and POST /bookings/{id}/cancel cancels. Each create can carry an idempotency_key.
• Webhooks: every booking, session, offering, customer and account change is an event, sent to your URLs and signed with HMAC-SHA256.
• OpenAPI: openapi.json describes every operation.
• MCP, for your own assistant: Claude Code and Cursor connect with an API key; claude.ai and ChatGPT connect by signing in to your daybag account. See MCP.

The API, MCP and webhooks come with every plan, including Free. See the developer overview, the API docs and pricing.