Casa Layer · Every guest, remembered.

The Casa API is a headless, read-only surface over the canonical guest data model: guests, master profiles, reservations, the event log, reviews, loyalty, channels, spaces, and properties. Responses are JSON; every endpoint sits under /v1.

Base URL

https://api.casa-layer.com

Authentication

Pass an API key as a bearer token on every request:

curl https://api.casa-layer.com/v1/master-profiles?q=ada \
  -H "Authorization: Bearer casa_your_key_here"

Keys are generated in the app under Account settings and are shown once at creation. They carry the full read surface (see scopes); integration metadata and key management are session-only and excluded from key access.

Tenant scope

Every request is scoped to your property group by default — data across all of your properties. Narrow to one property either by pinning the key at creation or per-request with the X-Property-Id header:

curl https://api.casa-layer.com/v1/reviews/summary \
  -H "Authorization: Bearer casa_your_key_here" \
  -H "X-Property-Id: 7c9e6679-7425-40de-944b-e07fc1f90ae7"

Scope is resolved server-side from the credential; a property outside your group returns 403.

Pagination

Every list and search endpoint is keyset-paginated. Responses carry the rows plus a cursor:

{ "data": [ ... ], "next_cursor": "eyJ2IjoxLCJrIjpb...", "has_more": true }

limit sets the page size (default 100, max 500) — it is not a cap on the total dataset. To retrieve everything, pass the next_cursor from one response back as the cursor query param on the next request, and repeat until next_cursor is null:

# first page
curl "https://api.casa-layer.com/v1/master-profiles?limit=500" \
  -H "Authorization: Bearer casa_your_key_here"

# next page
curl "https://api.casa-layer.com/v1/master-profiles?limit=500&cursor=eyJ2IjoxLCJrIjpb...==" \
  -H "Authorization: Bearer casa_your_key_here"

Cursors are opaque and stable under concurrent inserts — walking them never skips or double-counts a row. A malformed cursor returns 400 invalid_cursor.

Errors

Errors are JSON with a machine-readable error code:

Status	Body	Meaning
`400`	`{ "error": "invalid_cursor" }`	Malformed pagination `cursor`.
`401`	`{ "error": "unauthorized" }`	Missing, unknown, or revoked credential.
`403`	`{ "error": "forbidden", "scope": "read:guests" }`	Valid credential, missing scope (or a drill-down outside your group).
`404`	`{ "error": "not_found" }`	No such resource within your scope.

Playground

Every endpoint page in this reference has an interactive playground — paste your API key into the auth field and requests run against the live API with your tenant’s data.

Looking for AI-assistant access? The MCP server exposes the same data through seven tools, authenticated with the same keys.

API documentation

Endpoints

API Reference

Base URL

Authentication

Tenant scope

Errors

Playground

​Base URL

​Authentication

​Tenant scope

​Pagination

​Errors

​Playground

Base URL

Authentication

Tenant scope

Pagination

Errors

Playground