Quickstart

On this page you will get a token with your partner credentials and send a room and rate query. You need an apiKey, an apiSecret and the hotel’s HMS ID (hotelID); if you do not have them yet, contact support.

1. Get a token#

The login endpoint takes form fields and needs no authentication header:

Terminal

curl "https://test.hms.gen.tr/external/public/login" \
  -d "apiKey=$HMS_API_KEY" \
  -d "apiSecret=$HMS_API_SECRET" \
  -d "hotelCode=1000"

Response · 200

{
    "success": true,
    "hotelCode": "1000",
    "token": "eyJlbmREYXRlIjp7ImRhdGUiOiIyMDI2LTA5LTE1IDEwOjI0OjMxLjAwMDAwMCIs…",
    "hotelSeoUrl": "demo-otel"
}

Store the token; it is used on every request for this hotel for 7 days.

Terminal

export HMS_TOKEN="eyJlbmREYXRlIjp7ImRhdGUiOiIyMDI2LTA5LTE1IDEwOjI0OjMxLjAwMDAwMCIs…"

2. Query rooms and rates#

A two-night search for two adults:

Request

curl "https://test.hms.gen.tr/external/online/roomType" \
  -H "Authorization: Bearer $HMS_TOKEN" \
  -d "hotelID=1000" \
  -d "startDate=2026-08-18" \
  -d "endDate=2026-08-20" \
  -d "adultCount=2" \
  -d "language=en"

const res = await fetch("https://test.hms.gen.tr/external/online/roomType", {
  method: "POST",
  headers: { "Authorization": `Bearer ${process.env.HMS_TOKEN}` },
  body: new URLSearchParams({
    hotelID: "1000",
    startDate: "2026-08-18",
    endDate: "2026-08-20",
    adultCount: "2",
    language: "en"
  })
});
const data = await res.json();
if (!data.success) throw new Error(`${data.errorCode}: ${data.errorMessage}`);
for (const room of data.items) {
  console.log(room.name, room.roomCount, "rooms");
}

$ch = curl_init('https://test.hms.gen.tr/external/online/roomType');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('HMS_TOKEN')],
    CURLOPT_POSTFIELDS     => http_build_query([
        'hotelID'    => 1000,
        'startDate'  => '2026-08-18',
        'endDate'    => '2026-08-20',
        'adultCount' => 2,
        'language'   => 'en',
    ]),
]);
$data = json_decode(curl_exec($ch), true);
if (empty($data['success'])) {
    throw new RuntimeException($data['errorCode'] . ': ' . $data['errorMessage']);
}
foreach ($data['items'] as $room) {
    echo $room['name'], ' · ', $room['roomCount'], " rooms\n";
}

3. Read the response#

Each room type contains its board types (accommodationTypes) and each board type its price options (prices). A truncated sample:

Response · 200 (truncated)

{
    "success": true,
    "items": [
        {
            "id": 2,
            "name": "Standard Room",
            "roomCount": 5,
            "currency": "TRY",
            "accommodationTypes": [
                {
                    "id": 2,
                    "title": "Bed & Breakfast",
                    "priceType": 0,
                    "prices": {
                        "2-1": {
                            "total": 2,
                            "price": "1930.00",
                            "currency": "TRY",
                            "nonRefundable": "",
                            "id": "2/2"
                        },
                        "2-0": {
                            "total": 2,
                            "price": "1737.00",
                            "currency": "TRY",
                            "nonRefundable": "[NR]",
                            "id": "2-0/2"
                        }
                    }
                }
            ]
        }
    ],
    "count": 1
}

2-1: 2 persons, standard (refundable) rate. 2-0: 2 persons, non-refundable rate (nonRefundable: "[NR]").
price is the total for the stay; total is the number of nights. Nightly rates are in the prices[] array of the full response.
In the booking, the room type id is sent as roomTypeID and the board type id as ratePlanID.

What next#

Booking flow — from selection to the BookingPushRQ push
Payment flow — pay at hotel, bank transfer, credit card, online payment
Error codes — errorCode and message values

Last updated: 8 September 2026Found a mistake? Let us know