API

Overview

The BORA API is the same surface the product is built on — there is no second-class public tier. Read a schedule, check availability, create a booking, adjust inventory or pricing: what the interface does, the API does.

It is available as REST and as GraphQL, so an integration can take whichever fits it. Every response is JSON, and every call is authenticated per operator.

Access and authentication

Access is granted per operator, and what a given set of credentials may reach is agreed with it — an integration that only reads schedules is not given the ability to write bookings.

The address to call and the credentials to call it with are not published here.

What the API covers

Schedules and sailings, live availability, bookings, pricing, reporting and payments — the same modules an operator runs, reachable programmatically rather than only through the interface.

Endpoint-by-endpoint detail — paths, fields, types — lives in the OpenAPI specification rather than on this page. That is deliberate: one description of the interface, kept current with the interface, instead of a second one here that drifts.

Limits, pagination and errors

Requests are rate-limited and list responses are paginated. The limits that apply are set per operator rather than fixed, so a bulk import is something to arrange rather than something to work around.

Error codes and what each one means are part of the specification, so an integration branches on the same definitions the API is built from.

GraphQL

The same data is available over GraphQL, for a caller that would rather ask for exactly the fields it needs in one round trip than assemble them from several REST calls. It runs under the same per-operator authentication.

The OpenAPI specification

There is a full OpenAPI specification for the API, and it — not this page — is the reference to build against. It is not published here; ask for it.

Frequently asked questions

Is the BORA API REST or GraphQL?

Both. The same data is available over REST and over GraphQL, under the same per-operator authentication.

How is the BORA API authenticated?

Per operator, and what a set of credentials is allowed to reach is agreed with the integration. The credentials themselves are not published here.

Are there rate limits?

Yes, and list responses are paginated. The limits are set per operator rather than fixed, so a bulk import is something to arrange rather than work around.

Can the BORA API create bookings?

Yes. Creating and changing bookings is part of the API, not a read-only view of it.