Machine-readable resources
| Resource | URL | Description |
|---|---|---|
| API catalog | https://www.denira.io/.well-known/api-catalog | Machine-readable catalog per RFC 9727 with links to docs, OpenAPI and status. |
| OpenAPI | https://www.denira.io/openapi/public-booking.json | OpenAPI 3.1 for the public booking and discovery endpoints listed below. |
| Status | https://www.denira.io/api/health | Public status endpoint for monitoring. |
| MCP server card | https://www.denira.io/.well-known/mcp/server-card.json | Server card for Denira's public MCP server, which describes denira.io. |
| Agent skills | https://www.denira.io/.well-known/agent-skills/index.json | Index of Denira's public agent skills with SHA-256 digests. |
Public endpoints
| Method | Path | Description |
|---|---|---|
| GET | /api/health | Status check. |
| POST | /api/public-booking/cart/bootstrap | Creates the guest's cart and sets its token as a cookie. |
| GET | /api/public-booking/cart | The guest's cart in the booking. |
| POST | /api/public-booking/reservations | Holds places while the guest pays. |
| POST | /api/public-booking/checkout/stripe | Creates a Stripe Checkout payment. |
| POST | /api/public-booking/checkout/invoice | Creates a booking paid by invoice. |
| POST | /api/public-booking/vouchers/preview | Checks a discount code or gift card against the booking. |
Authentication
The endpoints above need no sign-in. The cart, reservations and checkout belong to a cart token. POST /api/public-booking/cart/bootstrap creates it and sets the denira_public_booking_cart cookie. Without the cookie, send the token in the x-denira-cart-token header. The token has nothing to do with signing in to the admin.
Without a token, GET /api/public-booking/cart returns an empty cart, reservations and checkout answer 400, and the voucher check answers 403 when the reservations don't belong to the token.
Denira does not publish OAuth or OIDC metadata for the admin, because there is no OAuth resource for agents yet.
Examples
Create a cart and fetch it with its token. merchantId is the facility's id in Denira.
curl -X POST https://www.denira.io/api/public-booking/cart/bootstrap \
-H "Content-Type: application/json" \
-d '{"merchantId": "<facility id>", "locale": "en"}'
# Response: {"success": true, "cartToken": "…"}
# And the cookie: denira_public_booking_cart=…curl https://www.denira.io/api/public-booking/cart \
-H "x-denira-cart-token: <cartToken>"