API keys and webhooks

Heroes ships a documented REST API to read and write your data from any third-party tool: CRM, accounting software, custom BI dashboards…

Generate a key

Integrations → API keys → + New key. Give it a name ("Zapier", "Sage"…) and pick permissions:

• Read-only (view only)
• Read-write (create / edit)
• Admin (including billing and team)

The key is displayed once. Copy it to your password manager; you won't see it again.

Main endpoints

• GET /api/v1/reservations — reservation list
• POST /api/v1/reservations — create a reservation
• GET /api/v1/rooms — types and rooms
• GET /api/v1/availability — daily availability
• GET /api/v1/invoices — invoices

Full docs on /integrations/api-keys → Documentation button.

Webhooks

Instead of polling the API, subscribe to events:

• reservation.created, reservation.cancelled
• guest.checked_in, guest.checked_out
• invoice.paid, payment.failed

Heroes will POST a JSON payload to your URL on every event. HMAC signature to verify origin.

Rate limits

120 requests per minute per key. Above that, HTTP 429. Beyond normal needs, contact support for a higher quota.