Spot Slots for developers

API and webhooks

Read your experiences, availability and bookings; add bookings taken outside Spot; and get a webhook the moment a booking is made, changed or cancelled. Make keys and webhooks in Settings → API and webhooks.

Authentication

Send your key as a Bearer token. Keys belong to your company; keep them on your server, never in a browser or app.

curl https://europe-west1-marketinglabstudio-61305.cloudfunctions.net/api/v1/experiences \
  -H "Authorization: Bearer spot_live_…"

Money is in minor units (cents). Dates are YYYY-MM-DD in the experience's city; times are ISO 8601. Errors are {"error": {"code", "message"}} with 400, 401, 404, 422 or 500.

Endpoints

GET/v1/experiences

Your experiences on Spot Slots, with customer types and prices, extras, questions, traveller details and pickup points.

GET/v1/availability?experience=ID&from=2026-11-01&to=2026-11-30

Departures with capacity and places left (up to 92 days).

GET/v1/bookings?from=2026-11-01&to=2026-11-30[&by=booked]

Bookings by trip date (or by the date they were made with by=booked), up to 92 days.

GET/v1/bookings/{id}

One booking.

POST/v1/bookings

Add a booking taken outside Spot (your own site's checkout, a phone line). Places are taken straight away; the money is yours to handle.

{
  "departureId": "…",            // from /v1/availability
  "quantities": {"adult": 2, "child": 1},
  "customer": {"name": "Ana López", "email": "ana@example.com", "phone": "+34…"},
  "payment": "paid",             // paid | unpaid | free
  "totalCents": 13000,           // optional: your price instead of Spot's
  "sendConfirmation": true,      // email Spot's ticket to the customer
  "language": "es"               // en | es | fr | de
}

POST/v1/bookings/{id}/cancel

Cancel a booking ({"reason": "…", "notifyCustomer": true}). Bookings paid online through Spot are refunded in full.

Webhooks

Spot POSTs JSON to your URL for booking.created, booking.cancelled and booking.updated (moved, checked in, paid). Answer with a 2xx within 10 seconds; failures are retried after 1, 5, 30, 120 and 720 minutes.

POST https://yoursite.com/spot-webhook
Spot-Signature: t=1730000000,v1=5257a869…

{"id": "…", "type": "booking.created", "created": "2026-11-01T10:00:00Z",
 "data": {"booking": { …same shape as GET /v1/bookings/{id}… }}}

Check the signature: HMAC-SHA256 of {t}.{raw body} with your webhook secret must equal v1, and t should be within a few minutes of now.

const [t, v1] = header.split(",").map((p) => p.split("=")[1]);
const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
const ok = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));

Booking sites

GetYourGuide, Viator and resellers using the OCTO standard (Klook, Headout, Tiqets and others) connect with their own credentials from Settings, not with this API.