List bookings over a period

GET /api/v1/bookings

The bookings of the organization over a period. from and to are required: the product reads a calendar, and there is no unbounded listing.

Authorization

Query parameters

Example

curl -H "x-api-key: $VILLASLOT_API_KEY" \
  "https://villaslot.app/api/v1/bookings?from=2026-09-01T00:00:00Z&to=2026-09-30T23:59:59Z"

Response

• 200 OK — the period, its timezone and currency, and the bookings. Each booking carries propertyName, customerName and blocksSlot.

{
  "success": true,
  "data": {
    "from": "2026-09-01T00:00:00.000Z",
    "to": "2026-09-30T23:59:59.000Z",
    "timezone": "Asia/Makassar",
    "currency": "IDR",
    "bookings": [
      {
        "id": "5b2c…",
        "propertyId": "1f0a…",
        "propertyName": "Villa Suar",
        "customerId": "8d3e…",
        "customerName": "Tomas Lindqvist",
        "startAt": "2026-09-12T05:00:00.000Z",
        "endAt": "2026-09-12T07:00:00.000Z",
        "kind": "SHOOT",
        "status": "CONFIRMED",
        "paymentStatus": "PARTIALLY_PAID",
        "priceAmount": 2800000,
        "currency": "IDR",
        "depositPercent": 30,
        "bufferMinutes": 30,
        "holdExpiresAt": null,
        "blocksSlot": true
      }
    ]
  }
}

What it refuses

• 422 Unprocessable Entity — from or to missing or unparsable.
• 401 Unauthorized — missing or invalid key, or a key whose bearer left the organization.
• 404 Not Found — unknown id, or an id belonging to another organization. The two are deliberately indistinguishable.
• 429 Too Many Requests — over 120 requests in a minute for this key.

Notes

• blocksSlot is the engine's answer, not a column: a cancelled or expired booking stays visible but no longer occupies its slot, and a hold occupies it or not depending on the organization setting.
• The client link token of a booking is never returned: it is the customer's access title to their own page.