BookDirect docs v1 (stable)
Product: a property management system. Hotels, shortlets, and apartments are all properties.
Engineering: three how to build playbooks. Each step names one winner URL. Lodging only — food, cars, events, rides are later versions.
The frontend browse x-api-key is public. IDOR is Core path settings and Middleware.
Three playbooks
- Frontend — how to build screens. Call only the winner URL.
- Middleware — how to build processors, webhooks, workers. Third parties, then write Core. Enforce IDOR here.
- Core — how to use Nellalink. API-key path settings for public vs write keys. Do not add PSP, email, or Google Hotel logic.
Winner rule
- If only Core has the operation → frontend calls Core.
- If Middleware later adds the same capability → frontend switches to Middleware. Core becomes an implementation note for Middleware.
- Never list two “pick one” URLs. The loser goes under Do not call (superseded) with a date.
v1 winners at a glance
| Step | Winner | Full URL |
|---|---|---|
| Register | Core | POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/register |
| Login | Core | POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/login |
| Create property | Core | POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/smart-meta-manager/entity/property |
| Check availability | Middleware | POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/availability/check |
| Create booking | Core | POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/smart-meta-manager/entity/booking |
| Start payment | Middleware | POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/payments/initialize |
| Request refund | Middleware | POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/refunds |
| Send booking email | Middleware | POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/emails/send |
| Push / pull Google rates | Middleware | POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/google-rates/push |
Middleware routes marked to implement are the API-first contract. Implement them from specs/middleware/v1/openapi.yaml. Do not invent a second Mongo source of truth.