Authentication

All partner-facing requests (under /api/partner/**) must authenticate using an API key passed in the header below. API keys are strictly assigned per partner and must be kept secure.

Header format#

SECURITY NOTE

Your partner identity is derived strictly and exclusively from the X-API-Key request header. Do not provide any partner identifier or PartnerId inside any request payload, as the authenticated key serves as the single source of truth.

Header name	Format	Description
`X-API-Key`	`pt_[alphanumeric]`	A unique security key containing the `pt_` prefix, validated with each request.

Example shell execution#

A typical authenticated POST query targeting the property registration registry:

BASH

bash

curl -X POST https://BASE_URL/api/partner/property \
  -H "X-API-Key: pt_demo_partner_secret_12345" \
  -H "Content-Type: application/xml" \
  -d @property_notif.xml

Authentication error (401)#

If the API key is missing, empty, or fails credentials verification, the service returns a 401 Unauthorized status carrying the standard PartnerAckRS structure:

XML Response (401 Unauthorized)

xml

<?xml version="1.0" encoding="UTF-8"?>
<PartnerAckRS>
    <Errors>
        <Error Code="UNAUTHORIZED" Type="Validation" ShortText="Invalid API Key"/>
    </Errors>
</PartnerAckRS>

PreviousGetting Started

NextRate Limits