The four API surfaces we use
- Rates. Read rate plans, room types, restrictions. Write rate changes and derived-rate updates. Used by Auto-Discount Engine, Advanced Yield Rules, Corporate Rate Manager.
- Availability. Read inventory and left-to-sell. Write availability holds and inventory adjustments. Used by Group Booking Handler, Multi-Property Console.
- Reservations. Read reservations, notes, and modifications. Write reservation notes. Used by Guest Data Enricher, Housekeeping Sync, Review Aggregator, Analytics Export Pack.
- Content. Read property content, room descriptions, images. Read-only for now. Used by Direct Booking Booster.
OAuth via SiteMinder login
Activation uses standard OAuth 2.0 against the SiteMinder authorisation endpoint. You sign in on the official SiteMinder page and consent to the scopes the module needs. Rmsclaud receives an access token and refresh token, both stored encrypted at rest.
The token can be revoked from your SiteMinder console at any moment. Every Rmsclaud module using that token will immediately lose access, no support ticket required.
Being polite to the API
Rmsclaud modules respect SiteMinder rate limits with token-bucket throttling. Read-heavy modules (Analytics Export Pack, Multi-Property Console) coalesce reads into hourly windows. Write-heavy modules (Auto-Discount Engine, Advanced Yield Rules) batch rate changes into the smallest number of API calls that get the job done.
Guardrails
Rmsclaud modules cannot:
- Add or remove rate plans that were not authorised by scope
- Delete reservations — reservations are read + note-only
- Collect payment on behalf of the property (PCI-DSS out of scope)
- Change your SiteMinder user roles or permissions