GuestCraft developer guide

GuestCraft is pre-alpha. The product status says which capabilities are implemented, partial or planned; the guides below are the workflow contracts of what exists.

Start with the installation guide, then use the HTTP API guide or TypeScript SDK guide. Versions, release images and their verification are described in releasing.

Workflows

• Setup creates the first operator account, company and production workspace atomically. The setup code works only until setup completes; public sign-up is closed.
• Properties: local properties with their time zone and currency.
• Reservations and inventory and the front-desk screens: room types, rooms, guests, reservations, availability, Planning, Today, check-in and check-out, and housekeeping.
• Housekeeping tasks and maintenance tickets: generated and manual tasks, assignment, the room status, fault reports and photos.
• Rates and restrictions, policies and no-shows, folios and payments and online payments.
• Night audit and reports.
• Organizations and workspaces: provisioning, settings, reversible archival and organization Activity.
• Account security: two-factor sign-in, passkeys, organization security policies and password reset links.
• Enterprise identity: verified domains, OIDC and SAML single sign-on per organization, and SCIM 2.0 provisioning.
• Roles and property access: team, custom roles and property-scoped access.
• Guest identity, duplicates and consents: manual merge, consent history and owning-property reassignment.
• Guest data rights and retention: retention periods by purpose, erasure, access exports and legal holds.
• Channex: a member with channex.configure connects the workspace’s own Channex API key in /onboarding or Channels (Channex staging for a sandbox workspace, production otherwise); then booking import, ARI publication and guest messages each need their own mapping, activation and recovery steps; an imported booking’s no-show or invalid card is reported to its OTA. Saving a key starts no synchronization. The live test covers checks against a Channex test property.
• API keys and webhooks for integrations, and discovery and device sessions for native apps such as the mobile app.
• MCP server: GuestCraft’s public operations as tools for AI assistants, with an API key or organization token.
• OAuth applications: third-party applications and MCP clients that members authorize on a consent page, and the workspace’s list to revoke them.
• One-click deployment on Vercel, and installation with Docker Compose.

Channex property IDs and GuestCraft prop_… IDs belong to separate systems: listing Channex properties does not import them.

Reference and source

On your running instance:

• Documentation hub: /docs.
• Interactive API reference: /api/v1/docs.
• OpenAPI JSON: /api/v1/openapi.json.

In the repository:

• Checked-in OpenAPI 3.1 contract; its revision history is the changelog.
• SDK source and API route source.
• Contribution workflow.
• Repository boundaries and capabilities.
• Security design: design principles, countermeasures and cryptography.

Browsers authenticate with cookie sessions, and the SDK has no sign-in helper: see session authentication. Native apps discover an instance and sign in with a device token: see discovery and device sessions. Integrations use a workspace API key and receive signed webhooks: see API keys and webhooks.