Not a separate one. Ask us for a demo tenant and you get a real account seeded with fake data, on the same endpoints, with its own token. Point your integration at it and delete it when you are done.

Are there webhooks out of MangoHost?

Not yet. Today the flow is inbound — you push bookings and messages to us, and you pull the property state with the snapshot endpoint. If you need a push out, tell us what event and we will say honestly whether it is close.

What are the versioning guarantees?

The surface is versioned in the path at v1. We add fields to responses without warning and treat that as non-breaking, so parse defensively. We will not remove or repurpose a field on v1.

Is the API included in every plan?

Yes. API tokens are minted per property in Settings on any plan, and the API is not sold as an upgrade.

API v1

Three endpoints, and no surprises

Read the whole property in one call. Push booking requests and guest messages in. That is the entire surface — it is small, it is documented from the handlers rather than from a spec, and it is the same API our own marketplace connector uses.

Authentication

Mint a token per property in Settings → API. It is shown once. Send it as either header — they are equivalent, and the second exists because some platforms will not let you set Authorization.

Authorization: Bearer mh_live_xxxxxxxxxxxx
X-API-Key:     mh_live_xxxxxxxxxxxx

Tokens are scoped to one property. There is no cross-tenant token, so an integration serving several hotels holds several tokens — which is deliberate: a leaked token exposes one property, not a portfolio.

Conventions

Base URL: https://app.mangohost.ph/api/v1
Envelope: Every response is { "success": true, "data": … } or { "success": false, "error": { "message": … } }. Check success, not the shape.
Errors: 400 bad input · 401 bad token or bad signature · 404 not found or not linked · 429 rate limited. Validation failures return the failing fields.
Rate limit: 120 requests a minute, per IP, per endpoint. Over it you get a 429; back off and retry.
CORS: Open, and OPTIONS is handled — but do not put a token in a browser. It is a server-side credential.
Dates and money: Dates are YYYY-MM-DD. Amounts are numbers in the stated currency, and the default currency is PHP.

The endpoints

GET/snapshot

Property snapshot

Everything a listing needs in one call: the property profile and amenities, images, rooms, rate rules, sources, bookings for a date range, and — unless you turn it off — the monthly financials computed the same way the dashboard computes them.

Parameters for GET /snapshot
Parameter	Type	Notes
`from / to`	YYYY-MM-DD	Inclusive date range. Omit both for everything.
`roomId`	integer	Restrict bookings and financials to one room.
`currency`	PHP · USD · EUR	Converts the financials block. Defaults to PHP.
`includeFinancials`	boolean	Default true. Set false for a much cheaper call.
`includeRelations`	boolean	Default true. Embeds room and source objects in each booking.

POST/integrations/booking-requestsigned

Inbound booking request

A marketplace pushes a request in and it lands in the calendar as a real booking, against a real room, with the guest created if they are new. Availability is checked at entry, so a request for a room that is already sold is refused rather than recorded.

Parameters for POST /integrations/booking-request
Parameter	Type	Notes
`remoteRoomId`	integer	Your room id on the sending platform, mapped to a MangoHost unit.
`checkIn / checkOut`	YYYY-MM-DD	Required.
`guestName`	string	Required. `guestEmail` and `externalGuestId` optional.
`externalRef`	string	Your id for the booking. Used to keep the two sides in step.
`totalPrice / currency`	number · PHP USD EUR	Optional. Defaults to PHP.
`bookingType`	overnight · day_use	Optional. Defaults to overnight.

POST/integrations/messagessigned

Inbound guest message

A guest writes on the marketplace and the message appears in the property's inbox, in the thread for their booking. Staff reply in MangoHost rather than in a second tab.

Parameters for POST /integrations/messages
Parameter	Type	Notes
`galeraThreadId`	string	Thread the message belongs to. Must already be linked.
`externalMessageId`	string	Your message id — makes re-delivery safe.
`body`	string, ≤4000	The message text.
`senderName`	string	Defaults to “Guest”.

A snapshot call, start to finish

curl -s "https://app.mangohost.ph/api/v1/snapshot?from=2026-08-01&to=2026-08-31&currency=PHP" \
  -H "Authorization: Bearer $MANGOHOST_TOKEN"

{
  "success": true,
  "data": {
    "hotel":   { "name": "...", "amenityGroups": [ ... ] },
    "rooms":   [ ... ],
    "sources": [ ... ],
    "bookings":[ ... ],
    "financials": {
      "currency": "PHP",
      "monthly": [ { "year": 2026, "month": 8, "occupancy": 0.663, "adr": 3854, ... } ]
    }
  }
}

The financials block is computed by the same engine the dashboard uses, so occupancy, ADR and RevPAR in your integration match the numbers the owner sees on their screen. Set includeFinancials=false when you only need availability — it is a much cheaper call and the one a listing should be making on a schedule.

Signing the two write endpoints

Once a connection has a webhook secret, the two POST endpoints require an HMAC signature alongside the bearer token. The token says who you are; the signature says the body was not altered and the request is not a replay.

Scheme: HMAC-SHA256 over `${timestamp}.${rawBody}`, sent as `sha256=<hex>`
Headers: x-int-timestamp — milliseconds since epoch
x-int-signature — sha256=<hex>
Replay window: 5 minutes either side. Outside it the request is rejected even with a correct signature, so sign at send time rather than reusing a header.
Comparison: Constant-time. A wrong signature and a wrong length both fail identically.

If no secret has been established for the connection, signature headers are not required and the bearer token stands alone. Establish one for anything running in production.

Known limits

What the API does not do

No outbound webhooks. Nothing is pushed to you when a booking changes in MangoHost; poll the snapshot endpoint.
No write access to rooms, rates or expenses. Bookings and messages come in; everything else is read-only.
No pagination on snapshot. Constrain it with from and to instead — an unbounded call on a property with years of history is slow, and the date range narrows the database read, not just the response.
No SDK. Three endpoints and an envelope did not warrant one. If that changes, this line changes with it.

Questions, answered

Is there a sandbox?: Not a separate one. Ask us for a demo tenant and you get a real account seeded with fake data, on the same endpoints, with its own token. Point your integration at it and delete it when you are done.
Are there webhooks out of MangoHost?: Not yet. Today the flow is inbound — you push bookings and messages to us, and you pull the property state with the snapshot endpoint. If you need a push out, tell us what event and we will say honestly whether it is close.
What are the versioning guarantees?: The surface is versioned in the path at v1. We add fields to responses without warning and treat that as non-breaking, so parse defensively. We will not remove or repurpose a field on v1.
Is the API included in every plan?: Yes. API tokens are minted per property in Settings on any plan, and the API is not sold as an upgrade.

Need a token to try it?

Ask for a demo tenant. You get a seeded property with its own token, on the real endpoints, and you can throw it away afterwards.

Book a demo