API

Overview

The BORA API is the same surface the product is built on — there is no second-class public tier. Read a schedule, check availability, create a booking, adjust inventory or pricing: what the interface does, the API does.

It is available as REST and as GraphQL, so an integration can take whichever fits it. Every response is JSON, and every call is authenticated per operator.

Further reading on the BORA blog: An MCP server for ferry operations: what an AI agent can and cannot do.

Access and authentication

Access is granted per operator, and what a given set of credentials may reach is agreed with it — an integration that only reads schedules is not given the ability to write bookings.

The address to call and the credentials to call it with are not published here.

What the API covers

Schedules and sailings, live availability, bookings, pricing, reporting and payments — the same modules an operator runs, reachable programmatically rather than only through the interface.

Endpoint-by-endpoint detail — paths, fields, types — lives in the OpenAPI specification rather than on this page. That is deliberate: one description of the interface, kept current with the interface, instead of a second one here that drifts.

Limits, pagination and errors

Requests are rate-limited and list responses are paginated. The limits that apply are set per operator rather than fixed, so a bulk import is something to arrange rather than something to work around.

Error codes and what each one means are part of the specification, so an integration branches on the same definitions the API is built from.

GraphQL

The same data is available over GraphQL, for a caller that would rather ask for exactly the fields it needs in one round trip than assemble them from several REST calls. It runs under the same per-operator authentication.

The OpenAPI specification

There is a full OpenAPI specification for the API, and it — not this page — is the reference to build against. It is not published here; ask for it.

Frequently asked questions

Is the BORA API REST or GraphQL?

Both. The BORA API offers the same ferry operations data over REST and over GraphQL, under the same per-operator authentication, with every response in JSON.

How is the BORA API authenticated?

The BORA API is authenticated per ferry operator, and what a set of credentials may reach is agreed with each integration. The credentials and the address are not published.

Are there rate limits?

Yes. The BORA API is rate-limited and paginates list responses. The limits are set per ferry operator rather than fixed, so a bulk import is something to arrange rather than work around.

Can the BORA API create bookings?

Yes. Creating and changing ferry bookings is part of the BORA API, which is the same surface the product is built on, not a read-only view.