PriceLabs integration

Who we are

YouAndHost (youandhost.com) is a direct-booking platform and property management system for short-term-rental hosts. Hosts list, take bookings and get paid here; an assistant answers their guests. We are the PMS in PriceLabs' model: we push listings, calendars and reservations to api.pricelabs.co/v2/integration/api, and PriceLabs calls three URLs of ours.

Our URLs

As POST /integration registers them. Staging is the same under staging.youandhost.com.

All three answer 200 {"ok":true} to the {"verify": true} body. Every other delivery must carry X-SOURCE, X-PL-TIMESTAMP, X-PL-REQUESTID, X-PL-SIGNED-HEADERS and X-PL-SIGNED-BODY. We verify both signatures as HMAC-SHA256 with the integration token (headers: v1. + HMAC of v1:<source>:<timestamp>:<request id>; body: HMAC of the headers signature followed by the raw body), refuse a timestamp more than five minutes off when we can read it, and apply each request id once, so retries are safe.

To confirm at certification: whether the signature is HMAC keyed with the token or a plain SHA-256 over token and components. The verifier is one function on our side and changes in a minute.

Identifiers

• listing_id is our listing's public id: eight characters, digits and capital letters, unique across all our hosts, never reused (for example 70WXWRHQ).
• user_token is the email of the host's PriceLabs account, which the host enters on our Integrations screen.
• reservation_id is our reservation's UUID; calendar blocks are block_<uuid>. Both are unique across the PMS.

What we push, and when

• POST /listings when a host switches a listing on, and again when its name, bedrooms, address, amenities or cleaning fee change. status is available while the host has it switched on (a draft the host is still writing is priced too, so it is ready the day it goes live) and unavailable when switched off or disconnected. We send location (latitude, longitude, city, country as ISO alpha-3), number_of_bedrooms, property_type: short_term_rental, amenities as lower-case names, and listing_fees.cleaning_fee.
• POST /calendar with 730 days from today when a listing is switched on, after every change to its prices, discounts, blocks or imported calendars, after every booking event, once a day for every synced listing, and in answer to the calendar trigger for the window named. Runs of identical days collapse into one entry with end_date. Prices are whole units of the listing's currency. available_units / booked_units / blocked_units are 1/0 for our single-unit listings. settings carries min_stay, check_in, check_out, the host's weekly and monthly discounts as percentages, and an extra-person fee with its trigger when the host has one. Days beyond the host's booking window are sent as available: the window is a sales rule, not a block.
• POST /reservations with every reservation since 2020-01-01 when a listing is switched on, and the changed one on every booking event. Statuses: booked (confirmed or completed), unconfirmed (awaiting payment or the host's answer), canceled (cancelled, declined, expired; cancel_time set). We fill total_cost, total_fees, total_taxes, host_payout, ota_commission (our platform fee), rental_revenue (the nights before discounts), discount, cleaning_fees, booking_source: youandhost and channel_reservation_id (our confirmation code). The host's own blocks and maintenance blocks go as blocked with a cost of 0; a released block is sent again as canceled. Bookings a host imports from Airbnb or Vrbo by calendar carry no price here, so they also go as blocked with booking_source naming the channel.
• POST /get_prices only when a host presses “Fetch prices” on our side, never on a schedule.

What we consume from a sync

price and min_stay per date. Our /integration registration says so: features.min_stay: true, everything else false, so hosts are not shown controls in PriceLabs that we would not apply. The table below says what would make each of the others true.

Credentials

One X-INTEGRATION-NAME and X-INTEGRATION-TOKEN for the whole PMS, held in our server environment, never on a host's device or in a browser. We can regenerate the token through /integration from an admin screen.

Not supported yet, and what each would take

Contacts

Integration questions and hosts alike: contact us.