Hotel API & XMLIntegration
Connect your booking platform, OTA, or travel management system to Safaryar Holidays's live inventory of 257+ Istanbul hotels. RESTful API, OTA-compatible XML feed, real-time availability, and instant confirmation — all under a single integration contract.
257+
Live Hotel Inventory
<200ms
Avg API Response Time
99.9%
Platform Uptime
40K+
Annual API Transactions
Integration Methods
Choose the integration method that best fits your technical stack — or combine multiple methods for different use cases.
RESTful API
Our primary integration method. JSON-based REST API with OAuth 2.0 authentication. Full CRUD support for availability, bookings, amendments, and cancellations. Comprehensive Swagger documentation available in the developer portal.
- JSON responses
- OAuth 2.0 auth
- Webhook support
- Rate: 100 req/sec
OTA XML Feed
OTA-standard XML messaging compatible with major GDS and legacy booking systems. Supports OTA_HotelAvailRQ, OTA_HotelResRQ, OTA_ReadRQ, and OTA_CancelRQ message sets. Ideal for systems already using XML-based hotel feeds.
- OTA 2015B standard
- SOAP envelope support
- Full OTA message set
- GDS-compatible format
Webhooks
Subscribe to real-time events for booking confirmations, cancellation notices, rate updates, and allotment changes. Push notifications eliminate the need for polling and keep your system in sync without API overhead.
- Booking confirmed events
- Cancellation notices
- Rate change alerts
- HMAC signature verification
API Capabilities
Our API exposes the complete booking lifecycle — from search and availability through to cancellation and voucher generation.
Hotel Search & Availability
Real-time search by destination, dates, occupancy, star rating, and board type. Returns live rates and allotment status with availability confidence indicators.
GET /hotels/searchGET /hotels/{id}/availabilityBooking & Confirmation
Instant booking with guaranteed confirmation. Includes room allocation, special request handling, and automated voucher generation with unique booking reference.
POST /bookingsGET /bookings/{ref}Amendments
Modify existing bookings — date changes, room upgrades, occupancy adjustments. Automatic rebooking with rate recalculation and penalty fee preview before commit.
PATCH /bookings/{ref}GET /bookings/{ref}/amend-quoteCancellations
Process cancellations with automatic penalty calculation. Returns cancellation fee preview before confirming. Full audit trail with confirmation receipts.
DELETE /bookings/{ref}GET /bookings/{ref}/cancel-quoteVoucher Generation
Generate branded booking vouchers in PDF format via API. Customizable with your agency logo, reference numbers, and contact details. Delivered as base64-encoded PDF.
GET /bookings/{ref}/voucherPOST /vouchers/customReporting & Analytics
Pull booking reports, revenue summaries, and cancellation statistics programmatically. Supports date range filtering, property-level breakdowns, and CSV export.
GET /reports/bookingsGET /reports/revenueTechnical Specifications
Built on enterprise-grade cloud infrastructure with performance and reliability at its core.
Azure Cloud Infrastructure
- Hosted on Microsoft Azure West Europe region
- Auto-scaling across multiple availability zones
- Azure CDN for global low-latency delivery
- Managed database with automated failover
Performance & Reliability
- 99.9% uptime SLA with financial backing
- Sub-200ms average API response time
- Sub-500ms for complex multi-property searches
- Real-time status page at status.safaryarholidays.com
Security & Compliance
- TLS 1.3 encryption for all API traffic
- OAuth 2.0 with JWT token authentication
- IP allowlisting available for enterprise partners
- Full audit logging with 90-day retention
Rate Limiting & Quotas
- 100 requests/second for search endpoints
- 20 requests/second for booking endpoints
- Burst allowance up to 5x standard rate for 10 seconds
- Custom quotas available for high-volume partners
Sample API Request
Get started quickly with our clean, well-documented API. Here's a sample hotel availability search request and response.
GET /v1/hotels/search
Authorization: Bearer {your_token}
Content-Type: application/json
{
"destination": "istanbul",
"check_in": "2025-06-01",
"check_out": "2025-06-05",
"occupancy": [
{
"adults": 2,
"children": 0
}
],
"currency": "USD",
"star_rating": [4, 5],
"board_type": "BB"
}{
"status": "success",
"results": 47,
"hotels": [
{
"id": "IST-0042",
"name": "Grand Hyatt Istanbul",
"stars": 5,
"district": "Taksim",
"rooms": [
{
"type": "Deluxe Double",
"board": "BB",
"net_rate": 142.00,
"currency": "USD",
"available": true,
"allotment": 8,
"cancellation": "free_until_2025-05-29"
}
]
}
],
"token": "search_abc123",
"expires_at": "2025-04-05T14:32:00Z"
}Developer Resources
Everything you need to integrate quickly and ship confidently.
API Documentation
Full Swagger/OpenAPI 3.0 docs with interactive request builder. Browse every endpoint, see example payloads, and test against our sandbox.
Sandbox Environment
Fully isolated test environment with simulated hotel inventory, booking flows, and edge cases. No billing in sandbox — test as much as you need.
SDK Libraries
Official client libraries for JavaScript/TypeScript, Python, PHP, and Java. Auto-generated from our OpenAPI spec and maintained on GitHub.
Postman Collection
Pre-built Postman collection covering all endpoints with environment variables configured for both sandbox and production use.
Technical Questions
What is hotel XML API integration?
Hotel XML API integration is a machine-to-machine connection that lets your booking platform read a supplier's live hotel inventory — availability, net rates, room content, and cancellation rules — and send bookings back automatically, without anyone rekeying data. The XML (or JSON REST) messages act as a shared language between our booking engine and yours, so your system can search our 257+ contracted hotels, confirm rooms, and process amendments and cancellations in real time inside your own product.
How do travel agents get XML or API access to hotel inventory?
Access is granted per partner, not self-serve to the public. You apply for an account, we verify your trade credentials (IATA, TURSAB, or a national tourism registration), and on activation you receive OAuth 2.0 client credentials plus sandbox access. Agencies that just want to book manually can use the B2B portal with no integration at all; agencies with their own booking engine or OTA connect over the REST API or OTA-compatible XML feed. Either way, credentials are issued only to verified travel businesses.
What is the difference between XML and an API for hotel booking?
In travel the two terms are often used interchangeably, but strictly an API is the interface — the set of endpoints and rules your system calls — while XML is one data format those messages can be encoded in. Our REST API returns JSON and is the recommended path for new builds; our OTA-standard XML feed carries the same booking lifecycle in the XML message sets (OTA_HotelAvailRQ, OTA_HotelResRQ, and so on) that legacy and GDS-connected systems already speak. Both hit the same live inventory; you choose the format your stack supports.
What is B2B hotel booking and how does the API support it?
B2B hotel booking is the travel trade buying rooms at net wholesale rates to resell to their own clients, rather than consumers booking retail. Our API is the connectivity layer for that model: it exposes net rates, real-time availability, instant confirmation, custom markup handling, and consolidated reporting so an agency, tour operator, or OTA can embed wholesale booking directly in its own workflow. For teams that prefer a browser over an integration, the same inventory is available through our B2B booking desks.
How long does a typical API integration take?
Most experienced development teams complete the core search and booking integration within 3-5 business days using our REST API. Our sandbox environment, Postman collection, and SDK libraries are designed to minimize integration time. We also provide dedicated technical support during the integration phase.
Is there a difference between the sandbox and production environments?
The sandbox uses simulated hotel data that mirrors production data structures exactly. All endpoint signatures, response formats, error codes, and webhook events are identical between environments. The only difference is that sandbox bookings are not real and no billing occurs.
What authentication method does the API use?
We use OAuth 2.0 with client credentials flow. You receive a client ID and secret upon account activation. Exchange these for a JWT access token, which is valid for 1 hour. IP allowlisting is available as an additional security layer for enterprise accounts.
Can we integrate your XML feed with our existing GDS setup?
Yes. Our XML feed follows the OTA 2015B standard, which is compatible with major GDS middleware and legacy travel booking systems. Our technical team provides mapping guidance for non-standard implementations at no additional cost.
Is there a revenue share or per-transaction cost for API use?
API access pricing is negotiated as part of your partner contract and is based on booking volume. There are no per-request charges — you pay for the hotel bookings you make, not the API calls you make. High-volume partners benefit from reduced per-booking fees.
What currencies does the API support for pricing and settlement?
The API returns rates in USD, EUR, GBP, or TRY based on the currency parameter you pass in each search request. Settlement with your agency is handled in the currency specified in your partner contract, and exchange rates are refreshed continuously so displayed prices match what's charged at booking confirmation.
How do you handle hotel and room-type mapping for channel manager integrations?
We provide a static hotel and room-type mapping file to simplify matching our inventory against your existing property database, with the exact formats confirmed during onboarding. Our integration team reviews your first mapping pass manually to catch mismatches before you go live, then hands off ongoing updates through a scheduled feed.
What error codes and retry logic should I build for the API?
The API returns standard HTTP status codes — 400 for invalid requests, 401 for auth failures, 429 for rate-limit breaches, and 5xx for server errors — with a structured JSON error body describing the issue. Standard rate-limit and error-handling guidance, including how to retry safely, is provided in the integration documentation.
Can I IP-allowlist specific addresses for API access as a security measure?
Yes, IP allowlisting is available as an optional security layer for enterprise partners. Once configured, requests from any IP outside your approved list are rejected at the gateway before reaching the booking engine, even with a valid OAuth token. Contact your technical account manager to enable this for your integration.
How do you notify partners of planned maintenance or API changes?
Planned maintenance windows are announced in advance via email to your registered technical contact and posted on our status page. Breaking API changes follow a deprecation notice period, with the old and new endpoint versions running in parallel during the transition so you can migrate without downtime.
Does the sandbox environment expire or require renewal?
No, sandbox access remains active for the lifetime of your partner account and does not expire or require periodic renewal. You can continue testing new features, running regression checks, or onboarding new developers against the sandbox at any time without requesting new credentials.
What data format does the cancellation policy field use in API responses?
Cancellation policies are returned as a structured cancellation-policy field with a deadline and a penalty amount in the booking currency, rather than free text, with the exact schema documented in the integration docs. This lets your system programmatically enforce cancellation cutoffs and display accurate penalty amounts to your customers without manual interpretation.
Do you support test webhooks before going live in production?
Yes, the sandbox environment includes a webhook simulator that lets you trigger sample booking-confirmed, cancellation, and rate-change events on demand, so you can verify your endpoint handles payloads correctly before switching to live traffic. HMAC signatures on simulated events use the same verification method as production.
Founder & CEO, Safaryar Holidays
Alper Tekin founded Safaryar Holidays in 2018 and leads its B2B hotel wholesale and DMC operations across Turkey.
Prefer to Book Without Integrating?
The same net inventory is available through our B2B booking desks and wholesale accounts — no development work required.
Turkey Hotel Wholesaler
Wholesale net rates and guaranteed allotment nationwide, bookable from a portal — no integration needed to start.
Learn moreIstanbul Hotel Wholesaler
Directly contracted Istanbul net rates and local support for agencies focused on the city.
Learn moreB2B Hotel Booking Istanbul
A dedicated B2B booking desk for the travel trade to search and confirm Istanbul rooms at net rates.
Learn moreReady to Connect Your Platform?
Apply for API access and our technical team will have you live on the sandbox within 24 hours. Integration support is included for all new partners at no charge.