Authentication
All requests use your FetchLayer API key as a Bearer token. There is no Booking.com account to create and no OAuth flow — this reads the properties, prices and reviews Booking.com publishes to anyone.
Sending requests
curl -X POST https://api.fetchlayer.dev/booking/search-hotels \
-H "Authorization: Bearer ss-your-key" \
-H "Content-Type: application/json" \
-d '{"destination":"Lisbon, Portugal","checkIn":"2026-10-15","checkOut":"2026-10-18"}'Keep your key secret
Every route is a POST
Every route takes a JSON body over POST, so nothing travels in a URL. The body is a strict object: an unrecognised field is rejected with a 400 naming it — {"error":"Unrecognized key: \"sortBy\""} — rather than quietly ignored, so a typo never returns silently wrong data. Each route has exactly one required field: destination on /search-hotels, hotel on /hotel-detail and /hotel-reviews, and url on /resolve-url. checkIn and checkOut are enforced as a pair.
Authentication errors
A missing or invalid key returns HTTP 401. A key scoped to other platforms returns HTTP 403.
{
"error": "Invalid API key"
}