API Terms
Additional terms for any Partner calling the Ventrata OCTO API — your license, your keys, and how we protect the platform.
Last updated: October 6, 2026
1. What this covers
Your access to the Ventrata APIs — our OCTO API, its capabilities and extensions, our endpoints, webhooks, environments, Credentials, and Documentation.
2. Your license
While these Terms are in force we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable, royalty-free license to call the APIs and to build and run your integration, for the purpose approved at Certification. We keep all rights not expressly granted.
3. Credentials
Your Credentials are an API key, used as a bearer token. A Supplier issues one by creating a connection to you from your Partner Gallery listing, and each Supplier issues its own key for its own connection. A key issued by one Supplier may only be used for that Supplier's connection.
Store keys securely — never in client-side code or source control. If you suspect a key has been compromised, ask the issuing Supplier to revoke and replace it within 48 hours. A Supplier can revoke its key at any time, and we can deactivate keys under section 3.10 of the Partner Terms.
4. Build to the Documentation
Call the APIs only through your certified integration, using documented endpoints, and follow the Documentation on how to use them — including rate limits, caching, holds, required fields, error handling, and how to handle changes we make. The Documentation is the detail; these Terms are the commitment to follow it.
Where you register a webhook endpoint, keep it healthy — reachable, responding within the documented time, and acknowledging deliveries — and monitor it yourself.
5. Don't misuse the APIs
Don't use the APIs in a way that is harmful, that we haven't agreed, or that they clearly weren't intended for. That includes:
anything that degrades the platform or other Partners' access;
working around rate limits or other controls;
extracting data outside a genuine booking purpose;
holding inventory you aren't selling;
reverse engineering;
disguising the source of your traffic; or
testing against live data, or outside the environments we provide for it.
6. Changes to the APIs
We may change, add, or remove functionality. We'll give you:
at least 3 months' notice before sunsetting a major API version; and
at least 1 month's notice before a breaking change to a documented endpoint,
except where a change is needed urgently for security, the law, or to stop abuse. Complete required migrations within the notice period; we may suspend an integration still running on a sunset version afterward.
7. Automated booking
If your integration books, amends, or cancels without a person operating it — an AI assistant or agent — tell us at Certification and identify that traffic as set out in the Documentation. We may apply separate limits, capabilities, and Supplier opt-in.
8. Protecting the platform
In addition to section 12 of the Partner Terms, if your integration is degrading platform performance, exceeding published limits, or breaching sections 4 or 5, we may do any of the following immediately and for as long as the problem lasts:
(a) apply stricter rate limits to your traffic than those published, temporarily;
(b) deactivate a webhook endpoint that is failing, timing out, or persistently returning errors; or
(c) suspend your API access.
We'll tell you when we do, and restore normal limits once the problem is resolved. Some of these measures are automated, so notice is on a best-efforts basis and may reach you after the event rather than before.
What else applies to you
Partner TermsOperator Connection (Backend) TermsQuestions about any of this? Email connectivity@ventrata.com. We'd rather explain a clause than have you guess at it.