Is the API an add-on?

No. The Open API is part of every VacayOps plan at no extra charge. A company admin creates tokens under Settings → Developers, and each token may make 600 requests a minute.

What can my software read and write?

Read: properties, reservations, tasks, owners and invoices, plus the books (chart of accounts, journal entries, trial balance, issued owner statements and trust balances) for companies that keep their books in VacayOps. Write: tasks. Your software can create a task and change its status, schedule, priority, instructions, work-completed notes or assignee. Properties, reservations, owners and invoices are read-only today.

Does a task created through the API behave like one created in the app?

Yes. It is the same document, field for field, so the same things happen: notifications go out, workflows fire, turnover readiness and inventory update. The API refuses to complete a task whose required forms have not been filled in, and it refuses to complete a time-tracked maintenance job, because labour pricing lives in the app.

Not in the API itself. For events going out, a workflow can post its details to any URL you give it, with the method and headers you choose, so a checkout, a form answer or a task change can reach another system. Invoices and tasks also take an updatedSince filter for polling; properties, reservations and owners do not yet.

What is never returned?

Door, lockbox and alarm codes, WiFi passwords, card and payment data, processor and pay-link identifiers, bank and tax identifiers, and internal notes. Every response field is listed explicitly in the reference, and tests check those values never appear.

Who can create a token, and what happens if one leaks?

Only an admin of the company. Each token carries the scopes that admin chose, reaches only that company, and the secret is shown once. Revoke it from the same screen and it stops working at once. Every token created or revoked is logged.

Does VacayOps have a Zapier app?

No. A workflow can post to a catch-hook URL, including one from an automation tool, and your own code can call the Open API. There is no VacayOps listing in an app marketplace.

There is no separate sandbox. Tokens work on your own company's data, so start with read scopes only, and use a name like “Cleaning app sync” so you can tell tokens apart and revoke the right one. No setup fee — onboarding, setup, configuration and training included.

Open API

Vacation rental software with an Open APIYour data, reachable by your own software.

Give a script, a cleaning app or your accountant's tools a token that reaches exactly what you choose: properties, reservations, tasks, owners, invoices and the books. Read what you need, create and update tasks, and revoke the token the moment you are done.

Open the API reference Book a 30-minute walkthrough

Included in every plan. Tokens are created by a company admin.

Request

curl 'https://app.vacayops.com/api/v1/reservations' \
  --url-query 'status=confirmed' \
  --url-query 'checkInFrom=2026-12-01' \
  -H "Authorization: Bearer $VACAYOPS_API_TOKEN"

Response

{
  "data": [
    {
      "id": "res_8f2a",
      "propertyId": "prop_ridgeview",
      "status": "confirmed",
      "channel": "direct",
      "checkIn": "2026-12-05",
      "checkOut": "2026-12-09",
      "guest": { "name": "A. Petrov", "email": "a.petrov@example.com" },
      "totalCents": 184000,
      "currency": "USD"
    }
  ],
  "nextCursor": null
}

What It Reaches

The records your operation already runs on

One company's data, in the shapes the app uses. Reservations carry dates, channel, guest contact details and totals. Tasks carry type, status, schedule and assignee. Invoices carry line items, totals and payment status. Companies that keep their books in VacayOps can also read the chart of accounts, journal entries, trial balance, issued owner statements and trust balances.

Properties: names, addresses, size, status and owner
Reservations: filter by property, status, channel and check-in or check-out range
Tasks: read, create and update cleanings, inspections and maintenance
Owners and invoices: contact details, line items and what has been paid
Books: the accountant endpoints, read-only, where the books live in VacayOps

Every endpoint in the API reference

19 operations, each with one scope

GET/propertiesproperties:read

GET/reservationsreservations:read

GET/taskstasks:read

POST/taskstasks:write

PATCH/tasks/{id}tasks:write

GET/ownersowners:read

GET/invoicesinvoices:read

GET/owner-statementsstatements:read

GET/trust/positiontrust:read

Each page lists its own, with every field and curl examples.

Scoped Tokens

A token holds only what you gave it

An admin creates a token under Settings → Developers and ticks the scopes it needs. Read scopes never change anything. A write scope does not include its read scope, so a token that creates tasks cannot list them unless you say so. Books scopes only work while the company keeps its books in VacayOps. Each token may make 600 requests a minute.

Reaches one company only: the one that created it
The secret is shown once, when the token is created
Revoke from the same screen and it stops working at once
Every token created or revoked is logged
Keep tokens on a server, never in a browser or a mobile app

Cleaning app sync

vop_a1b2…

Propertiesread

Reservationsread

Tasksread

Create & update taskswrite

Ownersread

Invoicesread

Secret shown once. Revoke any time; it stops at once.

Tasks, the Write Surface

A task from your system is a task in ours

Create a task from another system and it is the same document the app writes, field for field. So the things that follow a task in VacayOps follow it here too: notifications, workflows, turnover readiness and inventory. Send an Idempotency-Key and a retried request returns the original task instead of a duplicate.

Create with property, type, title, schedule, priority, instructions and assignee
Update status, schedule, priority, instructions, work-completed notes or assignee
Optional temporary door code for the task window on the property’s smart locks; the response reports its status, never the PIN
Completion is refused while a required form is unfilled, or on a time-tracked maintenance job, so the app’s rules hold

Housekeeping and task management

Create a task

POST /api/v1/tasks
Idempotency-Key: 6c1f…

{
  "propertyId": "prop_ridgeview",
  "type": "maintenance",
  "title": "Hot tub cover latch",
  "scheduledDate": "2026-12-09",
  "instructions": "Guest reported the latch sticking.",
  "generateDoorCode": true
}

201 Created
{ "id": "task_41", "status": "open",
  "statusCategory": "not_started",
  "hasDoorCode": true,
  "doorCode": { "status": "issued" } }

What Stays Out

Every response field is listed, and some never appear

The reference lists every field an endpoint returns. Codes, passwords, payment data and identifiers for banks, tax and processors are not among them, on any endpoint, with any scope. Tests check those values never appear in a response.

A task reports whether it has a door code; the code is only ever shown to the crew in VacayOps
Owner bank and payout details, tax ids and portal logins are never exposed
Invoice notes are returned because they print on the invoice; internal cost and markup are not

Door, gate, lockbox and alarm codes

WiFi passwords

Card and payment data, processor IDs, pay-link tokens

Bank and tax identifiers

Internal notes and cost or markup on invoices

Events Out

Workflows post to any URL

The API is for your software to ask. For VacayOps to tell, use a workflow: any trigger, from a checkout to a form answer to a task change, can run the Send to another app action, which posts the workflow’s details to a web address you give it, with the method and headers you choose. Your system can then call the API back for the full record.

Any workflow trigger, with the same conditions, branches and delays as the rest of your automation
Invoices and tasks also take an updatedSince filter for polling
Properties, reservations and owners do not have updatedSince yet

Workflow automation and outbound webhooks

Trigger: reservation checks out

Action: Send to another app (webhook), POST to your URL

Your system calls GET /tasks or POST /tasks back

From token to first call

1
Create a token
Settings → Developers. Name it for the integration and tick only the scopes it needs. Copy the secret; it is shown once.
2
Make a request
Send the token in the Authorization header as a bearer token. Every request answers with JSON, and errors carry a code and a plain-English message.
3
Page through lists
Long lists return a cursor. Keep the same filters and follow nextCursor until it is null, up to 500 records a page.
4
Write tasks safely
Send an Idempotency-Key on each create. A retry with the same key and body returns the original task.
5
Rotate or revoke
When the integration changes hands, revoke the token and create a new one. The old one stops at once.

Conventions

Boring on purpose, so your client code stays short.

OpenAPI 3 document

The reference and the spec at /api/v1/openapi.json come from the same source, so they cannot disagree.

Bearer tokens

One Authorization header. No OAuth dance, no app registration.

Cursor paging

cursor and nextCursor on every list, up to 500 a page. A cursor is only valid for the ordering it came from.

Money in cents

Every amount is an integer in a field ending Cents, with a currency beside it.

Dates and times

Calendar dates are YYYY-MM-DD. Timestamps are ISO 8601 in UTC.

Errors you can branch on

A machine-readable code and a message. 401, 403 insufficient_scope, 404, 409 and 429 with Retry-After.

Download openapi.json

Open API: questions

Is the API an add-on?: No. The Open API is part of every VacayOps plan at no extra charge. A company admin creates tokens under Settings → Developers, and each token may make 600 requests a minute.
What can my software read and write?: Read: properties, reservations, tasks, owners and invoices, plus the books (chart of accounts, journal entries, trial balance, issued owner statements and trust balances) for companies that keep their books in VacayOps. Write: tasks. Your software can create a task and change its status, schedule, priority, instructions, work-completed notes or assignee. Properties, reservations, owners and invoices are read-only today.
Does a task created through the API behave like one created in the app?: Yes. It is the same document, field for field, so the same things happen: notifications go out, workflows fire, turnover readiness and inventory update. The API refuses to complete a task whose required forms have not been filled in, and it refuses to complete a time-tracked maintenance job, because labour pricing lives in the app.
Are there webhooks?: Not in the API itself. For events going out, a workflow can post its details to any URL you give it, with the method and headers you choose, so a checkout, a form answer or a task change can reach another system. Invoices and tasks also take an updatedSince filter for polling; properties, reservations and owners do not yet.
What is never returned?: Door, lockbox and alarm codes, WiFi passwords, card and payment data, processor and pay-link identifiers, bank and tax identifiers, and internal notes. Every response field is listed explicitly in the reference, and tests check those values never appear.
Who can create a token, and what happens if one leaks?: Only an admin of the company. Each token carries the scopes that admin chose, reaches only that company, and the secret is shown once. Revoke it from the same screen and it stops working at once. Every token created or revoked is logged.
Does VacayOps have a Zapier app?: No. A workflow can post to a catch-hook URL, including one from an automation tool, and your own code can call the Open API. There is no VacayOps listing in an app marketplace.
Is there a sandbox?: There is no separate sandbox. Tokens work on your own company's data, so start with read scopes only, and use a name like “Cleaning app sync” so you can tell tokens apart and revoke the right one. No setup fee — onboarding, setup, configuration and training included.

The API reference Read-only accountant access to the books Channels and integrations

Read the reference, then make your first call

Every endpoint, scope and field, with curl examples, generated from the same OpenAPI document the API serves. Or book a 30-minute walkthrough and we'll go through what you want to connect.