Partner API Overview

How to call the Partner API. Every path below already includes /api.

Base URL

https://service-gateway.loscenotes.com/api

Where to call

You are…	Base path	Credential	Guide
Booking from your own system	/api/partner	X-API-Key: sk_live_...	Public Partner API
Registering an organization	/api/partners	Public, rate limited	Registration
Signed in to the portal	/api/partner-portal	Partner JWT	Portal
Managing cenotes you supply	/api/partner-portal/cenotes	Partner JWT + role	Management
Staff managing organizations	/api/admin/partners	Admin JWT	Admin
Staff triaging support tickets	/api/admin/partner-support-tickets	Admin JWT	Admin
Editing organization settings	/api/partner-settings	Partner JWT	Management
Managing partner users	/api/partners/users	Partner JWT + permission	Management
Reading reports	/api/partner-reports	Partner JWT	Management
Managing reservations in the portal	/api/partner-reservations	Partner JWT	Reservations
Testing or triggering webhooks	/api/partners/webhooks	Partner JWT; trigger is admin-only	Management
Generating sandbox data	/api/partner-sandbox	X-API-Key: sk_test_...	Management
Simulating webhook delivery	/api/partner/webhooks/simulator	X-API-Key: sk_test_...	Management

Production API key

Use sk_live_* on /api/partner/* and on other production partner routes. sk_test_ is accepted only on /api/partner-sandbox/* and /api/partner/webhooks/simulator/*. Anywhere else the response is 403 error.partner.sandbox_key_not_allowed_on_production_api.

Not an integration route

POST /api/partner/seed-test-data is not part of the partner contract. The hosted API returns 403 error.partner.seed_not_allowed_in_production.

Credentials

• Send X-API-Key. There is no X-API-Secret.
• Turning API access on does not create a key. Create or regenerate returns the full key once.

Response wrapper

{
  "success": true,
  "message": "partners.portal.dashboard_retrieved",
  "data": {},
  "pagination": {
    "total": 25,
    "perPage": 15,
    "currentPage": 1,
    "lastPage": 2
  },
  "currency": {
    "code": "MXN",
    "symbol": "$"
  }
}

• pagination appears on list routes
• currency appears on pricing-related routes
• data may be an object, an array, or a detail record

Error shape

{
  "success": false,
  "message": "validation.invalid_input",
  "statusCode": 400,
  "timestamp": "2026-03-10T18:00:00.000Z",
  "path": "/api/partner/reservations",
  "errors": {
    "messages": ["guestEmail must be an email"],
    "fields": {
      "guestEmail": ["guestEmail must be an email"]
    }
  }
}

Shared commerce routes

Booking also uses routes outside the partner prefixes:

• /api/pricing/*
• /api/payment-methods*
• /api/checkout/*
• /api/public/discount-rules/*
• /api/coupons/*
• /api/cenotes/*

Those pages are in this same site.

Sandbox when storage is not provisioned

• Portal /api/partner-portal/sandbox/*, including POST /api/partner-portal/sandbox/reset: HTTP 200 and a payload that explains unavailability. Reset exists only on this portal path.
• POST /api/partner-sandbox/generate-data: 400 partners.sandbox_schema_not_available
• GET /api/partner-sandbox/statistics: zeros
• DELETE /api/partner-sandbox/cleanup: success with deletedRecords: 0

---

Updated 2026-09-21 against the live Partner API.