Skip to main content

LosCenotes Partner Documentation

This site documents the current Partner surface of LosCenotes API.

What is covered​

The partner ecosystem is split into two groups:

1. Partner-specific APIs​

These are the endpoints implemented in src/partners/controllers and exposed through the global /api prefix:

  • Public Partner API: /api/partner/*
  • Partner Registration: /api/partners/register*
  • Partner Portal: /api/partner-portal/*
  • Admin Partners: /api/admin/partners/*
  • Partner Settings: /api/partner-settings/*
  • Partner Users: /api/partners/users/*
  • Partner Reports: /api/partner-reports/*
  • Partner Reservations: /api/partner-reservations/*
  • Partner Webhooks: /api/partners/webhooks/*
  • Partner Sandbox: /api/partner-sandbox/* (live — isolated partners_sandbox schema; use sk_test_ keys only on these tooling routes)
  • Webhook Simulator: /api/partner/webhooks/simulator/* (live — sk_test_ only; not for /api/partner/*)

2. Shared platform APIs used by partners​

Partners also consume shared endpoints outside src/partners, such as:

  • pricing calculation
  • checkout providers
  • payment methods
  • public discount rules and coupons
  • public cenote/service data

Those endpoints are documented here as shared platform APIs, not as part of the partner module itself.

Current verified scope​

  • 87 partner endpoints currently implemented in src/partners/controllers
  • global API prefix: /api
  • docs aligned to controller routes, not legacy naming

Start here​

Important notes​

  • All examples in this site use the real global prefix: /api
  • Prices exposed by the API are documented in cents unless stated otherwise
  • Some older internal docs still mention 83 or 89 endpoints; the current implementation exposes 87
  • Auth SSOT: X-API-Key → partner_api_keys (no x-api-secret); remint via regenerate only
  • Sandbox is live (schema partners_sandbox); sk_test_ keys work only on /api/partner-sandbox/* and the webhook simulator — they are rejected on /api/partner/* (sandbox_key_not_allowed_on_production_api)
  • Partner WebSocket realtime is shipped (PartnerRealtimeGateway, path /partner/ws; JWT + API key key_hash) — see Authentication
  • Metrics: Public Partner API request logs ingest to partner_api_logs; portal metrics UI shows that timeseries (empty → empty)
  • Billing: portal billing page is live but P2 partial (not full commercial billing)
  • Support tickets: live create/list (partner_support_tickets); portal /partner/support. Admin triage queue deferred
  • Webhook URLs: public HTTPS only; private/metadata rejected; outbound delivery uses maxRedirects: 0 + pinned DNS
  • Invite: pending membership + emailDelivery=pending_manual (no automatic email)
  • Commission: partner may update customRates[] only; seller_profiles.commissionRate is admin-only

Need raw OpenAPI?​

  • Main API reference: /docs
  • Partner-filtered reference: /partner-docs

Updated: 2026-08-03 — partners mutation harden (SSRF/DNS pin, invite pending_manual, commission admin-only, WEB create parity) aligned with API edfcba9a.