Developer API

Read your fleet, check availability, create bookings and receive webhooks — from your own website, channel manager or automation tool.

Authentication

Generate an API key in your dashboard under Integrations → API keys. The key is shown once — store it safely and never put it in client-side code. Send it on every request:

curl https://rentpilot-api.crcaway.workers.dev/api/v1/cars \
  -H "Authorization: Bearer rpk_live_YOUR_KEY"

All endpoints are scoped to your own account — a key can only ever see and write your data. Base URL: https://rentpilot-api.crcaway.workers.dev

GET/api/v1/cars

Returns your full fleet.

curl "https://rentpilot-api.crcaway.workers.dev/api/v1/cars" \
  -H "Authorization: Bearer rpk_live_YOUR_KEY"

// 200 OK
{
  "cars": [
    {
      "id": "car_abc123",
      "name": "Dacia Logan",
      "category": "sedan",
      "price_per_day": 25,
      "currency": "EUR",
      "seats": 5,
      "transmission": "manual",
      "fuel_type": "petrol",
      "year": 2022,
      "available": 1,
      "image_url": "https://…",
      "description": "…"
    }
  ]
}

GET/api/v1/availability

Checks whether a car is free for a date range. Query params: car_id, from, to (YYYY-MM-DD).

curl "https://rentpilot-api.crcaway.workers.dev/api/v1/availability?car_id=car_abc123&from=2026-08-01&to=2026-08-05" \
  -H "Authorization: Bearer rpk_live_YOUR_KEY"

// 200 OK
{
  "car_id": "car_abc123",
  "from": "2026-08-01",
  "to": "2026-08-05",
  "available": false,
  "conflicts": [
    { "pickup_date": "2026-08-03", "return_date": "2026-08-06", "status": "confirmed" }
  ]
}

GET/api/v1/bookings

Lists your bookings, newest first. Optional query params: status (pending / held / confirmed / cancelled / completed), from / to (filter by pickup date), limit (max 100, default 50).

curl "https://rentpilot-api.crcaway.workers.dev/api/v1/bookings?status=confirmed&limit=10" \
  -H "Authorization: Bearer rpk_live_YOUR_KEY"

// 200 OK
{ "bookings": [ { "id": "bk_…", "car_id": "car_…", "customer_name": "…",
  "pickup_date": "2026-08-01", "return_date": "2026-08-05",
  "status": "confirmed", "total_price": 100, "days": 4, "source": "cara_chat",
  "created_at": "2026-07-19 10:00:00" } ] }

POST/api/v1/bookings

Creates a booking (status pending — you confirm it in the dashboard or via your own flow). Required: customer_name, car_id, pickup_date, return_date. Optional: customer_phone, customer_email, pickup_location, notes.

curl -X POST "https://rentpilot-api.crcaway.workers.dev/api/v1/bookings" \
  -H "Authorization: Bearer rpk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_name": "Ana Pop",
    "customer_phone": "+40712345678",
    "car_id": "car_abc123",
    "pickup_date": "2026-08-10",
    "return_date": "2026-08-14"
  }'

// 201 Created → the booking object
// 409 Conflict → { "error": "Car is not available for those dates", "conflict": true }

Price is calculated as the car's base price_per_day × days. Seasonal pricing rules are not applied to API bookings in v1 — adjust the total in the dashboard if needed.

Webhooks

Add an endpoint under Integrations → Webhooks and pick events: booking.created, booking.confirmed, booking.cancelled. We POST JSON to your URL, retry up to 3 times (1s / 3s backoff), and keep a delivery log of the last 20 attempts.

Payload

{
  "id": "evt_9f2c1ab34d10",
  "event": "booking.created",
  "created_at": "2026-07-19T12:00:00.000Z",
  "data": {
    "booking": {
      "id": "bk_…", "status": "pending",
      "car_id": "car_…", "car_name": "Dacia Logan",
      "customer_name": "Ana Pop", "customer_phone": "+40712345678",
      "customer_email": null,
      "pickup_date": "2026-08-10", "return_date": "2026-08-14",
      "total_price": 100, "days": 4, "source": "api",
      "created_at": "2026-07-19 12:00:00"
    }
  }
}

Verifying signatures

Every delivery carries X-RentingPilot-Signature: sha256=<hex> — an HMAC-SHA256 of the raw request body using your endpoint's signing secret (shown on the Integrations page). Verify it before trusting the payload:

// Node.js
const crypto = require('crypto')
function verify(rawBody, signatureHeader, secret) {
  const expected = 'sha256=' + crypto.createHmac('sha256', secret)
    .update(rawBody).digest('hex')
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader))
}

Also sent: X-RentingPilot-Event (event name) and X-RentingPilot-Delivery (unique delivery id). Respond with any 2xx within 10 seconds; anything else is retried.

Calendar feeds (iCal)

Each car can expose a private iCal feed of its bookings — subscribe in Google Calendar, Apple Calendar or Outlook. Enable it per car under Integrations → Calendar feeds; you get a tokenised URL:

https://rentpilot-api.crcaway.workers.dev/api/v1/cars/CAR_ID/calendar.ics?token=YOUR_CAR_TOKEN

Bookings appear as all-day events (pending/held as tentative, confirmed as busy). Disable the feed any time to invalidate the link.

Rate limits & errors

60 requests per minute per API key. Responses include X-RateLimit-Remaining; exceeding the limit returns 429. Errors are always JSON: { "error": "…" } with conventional status codes (400 validation, 401 bad key, 404 not found, 409 date conflict, 429 rate limit).