Hostaway is a vacation rental property management system and channel manager. Its Public API is JSON over HTTPS at api.hostaway.com/v1 and covers listings, reservations, listing calendars, conversations and messages, tasks, reviews, and users. Reservation statuses reflect the channel, from new, modified, and cancelled to Airbnb's pending, awaitingPayment, and inquiry states. Unified webhooks post reservation created, reservation updated, and new message received events to your endpoint.
Through Fibric, an operator reads the reservation or conversation behind each event and proposes a message, a task, a calendar block, or a status change for your approval, leaving a receipt of what changed and how to undo it.
This is a reference listing. It documents what Fibric would read from Hostaway and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.
Inputs
Reservations through GET /v1/reservations with arrival and departure date filters, hasUnreadConversationMessages, and includeResources=1 for attached objects
Unified webhook events: reservation created, reservation updated, and new message received
Listing calendars through GET /v1/listings/{listingId}/calendar: isAvailable, price, minimumStay, closedOnArrival, closedOnDeparture
Conversations and messages through GET /v1/conversations and GET /v1/conversations/{conversationId}/messages
Tasks with title, status, assigneeUserId, canStartFromEvent, and shouldEndByEvent through GET /v1/tasks; reviews through GET /v1/reviews
The field-level change history of a reservation through GET /v1/reservations/{reservationId}/logs, and its rental agreement
Proposed actions
Target capability: propose a message to a guest with POST /v1/conversations/{conversationId}/messages
Target capability: propose a task with POST /v1/tasks, or an update with PUT /v1/tasks/{taskId}
Target capability: propose a calendar change with PUT /v1/listings/{listingId}/calendar or calendarIntervals: availability, price, minimum stay
Target capability: propose a reservation update with PUT /v1/reservations/{reservationId}, or a status of cancelled or noShow
Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.
What you can build
Schedule the turnover
On reservation created or updated, read arrival and departure per listing, and propose a task with canStartFromEvent departure and shouldEndByEvent arrival for the cleaner.
A Hostaway account whose dashboard exposes the API secret under Settings > Integrations > API; the secret is shown once
A token store: Hostaway asks you to keep the token until it expires rather than request one per call
An HTTPS endpoint that acknowledges webhook deliveries within 20 seconds; login, password, and a failure email are optional on the webhook
A receiver that tolerates out-of-order events, since a message webhook can arrive before the reservation created event
Authentication
OAuth 2.0 client credentials: your Hostaway account ID as client_id and the client secret from Settings > Integrations > API as client_secret, exchanged at POST /v1/accessTokens with scope general for a bearer token valid up to 24 months.
Limits
200 requests per 10 seconds per account ID and per IP address on most endpoints; POST /v1/reservations 200 per 10 seconds per account
POST /v1/conversations/{id}/messages is limited to 30 per minute per account
Webhooks deliver every supported event; Hostaway does not filter, and adds new event types over time
Transient delivery failures are retried 3 times within about an hour; other 4xx responses are final
Access and pricing
Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.
With OAuth 2.0 client credentials. The client_id is your Hostaway account ID and the client_secret comes from Settings > Integrations > API in the dashboard. POST /v1/accessTokens with scope general returns a bearer token, valid up to 24 months, which the connector stores and reuses.
Which events do Hostaway webhooks send?
Three at present: reservation created, reservation updated, and new message received. A unified webhook receives all of them; Hostaway does not filter and may add events, so the receiver ignores what it does not need. Failed deliveries are retried 3 times, then Hostaway emails the failure.
What are the Hostaway rate limits?
Most endpoints allow 200 requests per 10 seconds, counted per account ID and per IP address on a sliding window. Sending a message is 30 per minute per account, and price details 400 per 10 seconds. A 429 response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Retry-After.
Ask about Hostaway
Ask about the capabilities and requirements in this listing.
This connector listing is developed, published, and supported by Fibric. It describes integration with Hostaway through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy