Rules and limits

Allowed websites

Each website key lists the websites allowed to use it. Browser requests from any other website are rejected with 403.

• Websites are matched by protocol and domain. thestage.com is stored as https://thestage.com.
• www.thestage.com is a different website and must be listed separately.
• Requests made from a server have no browser origin and are accepted. They are subject to the same rate limits.

Rate limits

Limits apply per website key and per visitor IP address.

Requests	Limit
GET requests	120 per minute
POST /quote	30 per minute
POST /booking-requests	5 per hour

When a limit is reached, the API returns 429 with the code RATE_LIMITED. Wait before trying again.

Date holds

When a booking request is sent, the selected date is held and shown as unavailable while the venue reviews the request.

• The venue sets the hold period on the website key: 24 hours, 48 hours, 3 days, 7 days, 14 days, 30 days, or no time limit.
• A hold never lasts past the start of the slot.
• If the venue does not accept or decline the request within the hold period, the date becomes available again.
• With no time limit, the date stays held until the venue accepts or declines the request, and holdExpiresAt is omitted from the response.

Amounts and currency

Amounts are integers in the smallest unit of the currency (currency in the response). For example, 150000 in USD is USD 1,500.00.

These currencies have no smaller unit, so amounts are whole units: IDR, JPY, KRW, VND, CLP, ISK and UGX. For example, 75000000 in IDR is IDR 75,000,000. Other currencies use their standard number of decimal places, for example two for USD and EUR.

Dates and times

• Dates use the format YYYY-MM-DD.
• Timestamps such as holdExpiresAt use ISO 8601 in UTC.
• Slot times (startTime, endTime) are in the venue’s time zone.

Spam protection

POST /booking-requests accepts a field named website. Add it to your form as a hidden field that visitors cannot see or fill in, and always send it empty. Automated spam tools tend to fill in every field. When website has a value, the API returns a normal success response but does not create a booking request.

Errors

Errors return success: false and an error object:

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "invalid website key"
  }
}

Use code in your code. message is a readable explanation and can change.

Status	Code	Meaning
400	BAD_REQUEST	The request body is missing or is not valid JSON.
403	FORBIDDEN	The request comes from a website that is not allowed to use the website key.
404	NOT_FOUND	The website key does not exist or is disabled, or the venue, space, slot or package was not found or is not published.
409	CONFLICT	The selected date and slot are no longer available.
422	VALIDATION_ERROR	A field is invalid, for example a date in the wrong format or in the past, or an invalid email address.
429	RATE_LIMITED	Too many requests. See Rate limits.
500	INTERNAL_SERVER_ERROR	An unexpected error occurred. Try again later.