How to build: manage booking

List and read Core Backend (JWT + write/session key — not the public browse key). Cancel unpaid on Core Backend. Paid cancel / refund on Middleware Backend.

---

1. Guest — list my bookings

Core Backend · winner

GET https://backend-dev.bookdirect.live/public/api/v1/nellalink/smart-meta-manager/entity/booking?owned_by={session_user_uuid}&per_page=20&sort_by=created_at&sort_order=desc

x-api-key: {API_KEY}
Authorization: Bearer {access_token}

How to build the guest list: query owned_by={session.uuid}. Core Backend must ignore or deny a public key listing all bookings, and must scope GET-by-uuid to the JWT owner. If not available, recommend those path settings on Core Backend.

---

2. Guest — open one booking

Core Backend · winner

GET https://backend-dev.bookdirect.live/public/api/v1/nellalink/smart-meta-manager/entity/booking/{booking_uuid}

How to build detail: open a uuid from the guest’s list. Enforcement is Core Backend (or Middleware Backend later). See Security and IDOR.

Lookup by reference + email (legacy “manage without account”) should become Middleware Backend later so you do not expose a Core Backend-wide search. v1: prefer logged-in list.

---

3. Cancel (no money movement)

If the booking is pending (unpaid), frontend may:

Core Backend · winner for unpaid cancel

PUT https://backend-dev.bookdirect.live/public/api/v1/nellalink/smart-meta-manager/entity/booking/{booking_uuid}

{ "status": "cancelled" }

Only if owned_by is the session user and status is pending.

---

4. Cancel + refund (paid)

Middleware Backend · winner · to implement

POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/refunds

{
  "booking_uuid": "{booking_uuid}",
  "reason": "guest_cancelled"
}

Middleware Backend verifies the JWT owns the booking (or the property, for owners), calls the PSP, writes Core Backend payment / refund entity, sets booking cancelled when the refund succeeds.

Do not PUT Core Backend booking to cancelled and walk away if money was captured — that orphans the PSP charge.

---

5. Owner — reservations for a property

Two-step Core Backend read (hotel):

GET .../entity/room?parent_entity_type=property&parent_entity_uuid={property_uuid}
GET .../entity/rate_plan?parent_entity_type=room&parent_entity_uuid={room_uuid}
GET .../entity/booking?parent_entity_type=rate_plan&parent_entity_uuid={rate_plan_uuid}&per_page=100

Shortlet:

GET .../entity/booking?parent_entity_type=property&parent_entity_uuid={property_uuid}

How to build owner reservations: load bookings for properties this session owns. Core Backend (role / owned_by) and Middleware Backend (if you add an owner-reservations route) must deny a stranger’s property_uuid. Not a frontend IDOR task.

---

6. Resend confirmation email

Middleware Backend · winner · to implement

POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/emails/send

{
  "template": "booking_confirmed_guest",
  "booking_uuid": "{booking_uuid}"
}

---

Manage-booking checklist

• [ ] Guest list query uses owned_by=session uuid (UI). Core Backend path settings deny public-key booking lists
• [ ] Unpaid cancel → Core Backend PUT
• [ ] Paid cancel → Middleware Backend refunds
• [ ] Owner list scoped to properties they own
• [ ] Email resend via Middleware Backend only