API reference

Every endpoint of this server, listed from its routes. Requests and responses are JSON (file uploads are multipart). Sign in with POST /api/auth/login: the session cookie then authorises agency users under /api/a and platform staff under /api/admin, within their role’s permissions.

Agencies’ own systems use an API key instead: send Authorization: Bearer vwk_… (keys are created on the Developers screen of the portal). A key reaches only the endpoints of its scopes, within the rate limit of its agency; webhooks push booking and wallet events.