Overview

Developer Tools is the integration hub of Ananas GDS. It provides four distinct capability areas: token-based API access for partners, embeddable HTML/JS widgets for displaying fact sheets on external sites, outbound webhooks for real-time event delivery, connections to external GDS/OTA/PMS platforms, and a bulk data export engine. All capabilities are scoped to the authenticated owner; sub-users require the developer_tools permission flag.

API Keys

API keys (model ApiKey in the settings app) give external systems — tour operators, channel managers, and partner integrations — token-based read access to your data. Each key is tied to a whitelisted domain and carries per-resource permission flags.

FieldDescription
titleHuman-readable label for the key.
descriptionOptional usage note.
domainFK to Whitelist — restricts which domain may use the token in browser requests.
tokenAuto-generated 30-character dash-delimited token. Shown once on creation.
fact_sheetGrants access to the facts API endpoint.
stop_saleGrants access to the stop-sale API endpoint.
hotel_photosGrants access to the photos API endpoint.
last_called_atTimestamp of the most recent authenticated request.

The token is passed in the URL path of v1 API requests:

Example
GET https://app.ananas-gds.com/api/v1/facts/{token}/
GET https://app.ananas-gds.com/api/v1/photos/{token}/
GET https://app.ananas-gds.com/api/v1/stop-sale/{token}/

Domain Whitelist

Each API key requires a Whitelist entry. The whitelist associates a human-readable name with a domain pattern, allowing the backend to reject requests from unauthorised origins when the token is used in browser-side code.

EndpointDescription
GET /api/settings/whitelists/List all whitelisted domains.
POST /api/settings/whitelist/create/Add a new whitelisted domain.
PUT /api/settings/whitelist/update/{id}/Update domain name or label.
DELETE /api/settings/whitelist/delete/{id}/Remove a whitelisted domain.

API Key Endpoints

MethodPathDescription
GET/api/settings/api-keys/List all API keys for the account.
POST/api/settings/api-key/create/Create a new API key. Token is returned in this response only.
PUT/api/settings/api-key/update/{id}/Update key metadata (title, description, permissions).
DELETE/api/settings/api-key/delete/{id}/Revoke and delete a key. Existing requests using the token will immediately fail.

Embeddable Widgets

Widgets let you embed a styled fact sheet directly on any external website. Each widget is bound to a specific property and API key. You configure the visual appearance — fonts, colours, sections, layout — in the widget editor, then copy the generated embed code.

FieldDescription
keyUUID used in the embed URL. Auto-generated, never changes.
propertyThe property whose data is displayed.
selected_tokenThe API key token used to authenticate the widget data fetch.
font_size_baseBase font size in px (default 14).
font_selectFont family override.
background_color / border_colorHex colours for the widget container.
content_typebullet | text | rich | minimal — controls how facts are rendered.
dark_modeEnables dark background styling.
sectionsOrdered list of WidgetSection objects defining the layout.

Widget Sections

A widget is composed of one or more ordered sections. Each section has a type and optional style overrides:

TypeDescription
heroFull-width header with property name and optional subtitle.
bulletsBullet-point list of fact sheet entries.
paragraphFree-text block with optional title.
photo_gridPhoto gallery grid (uses photos_per_row config).
text_photoSide-by-side text and image layout.
custom_htmlRaw HTML block for custom content.

Embed Code

Three embed options are available from the widget editor:

Legacy Iframe
<iframe src="https://app.ananas-gds.com/widget/{key}/"
        width="100%" height="600" frameborder="0"></iframe>
JS Embed (recommended)
<div id="ananas-widget"></div>
<script src="https://app.ananas-gds.com/widget.js"
        data-key="{key}"></script>

Widget Endpoints

MethodPathDescription
GET/api/settings/widget/{property_id}/Get widget config for a property.
POST/api/settings/widget/create/Create a new widget for a property.
PUT/api/settings/widget/edit/Update widget appearance or section configuration.

External Connections

The Integrations section lets you connect Ananas GDS to external platforms. Supported system types cover GDS (Amadeus, Sabre, Travelport), OTA (Booking.com, Expedia, Airbnb, TripAdvisor), PMS (Oracle Opera Cloud, Mews, Cloudbeds, Apaleo, SiteMinder), and custom endpoints.

FieldDescription
nameFriendly name for the connection.
system_typegds | ota | pms | custom
providerSpecific provider (amadeus, sabre, oracle_opera, mews, etc.).
statusactive | inactive | error | pending
credentialsJSON of provider-specific auth credentials (encrypted at rest).
configProvider-specific configuration options.
inbound_tokenUUID used as the inbound webhook path for this connection.
last_synced_atTimestamp of the most recent successful sync.

Each sync attempt is recorded in a ConnectionSyncLog with status, records processed, records failed, and a message for debugging.

Integration Endpoints

MethodPathDescription
GET/api/dev/integrations/connections/List all configured external connections.
POST/api/dev/integrations/connections/Create a new connection.
GET/PUT/DELETE/api/dev/integrations/connections/{id}/Retrieve, update, or delete a connection.
POST/api/dev/integrations/connections/{id}/sync/Trigger a manual sync for a connection.
GET/api/dev/integrations/connections/{id}/sync-logs/List recent sync logs for a connection.
POST/api/dev/integrations/inbound/{inbound_token}/Inbound webhook receiver for a specific connection.

Outbound Webhooks

Register HTTPS endpoints to receive real-time notifications when data changes in Ananas GDS. Each webhook endpoint subscribes to one or more event types. Payloads are HMAC-signed using the endpoint's secret for verification.

Supported Events

EventTrigger
property.updatedProperty data changed.
stopsale.createdNew stop sale event created.
stopsale.updatedExisting stop sale event modified.
stopsale.cancelledStop sale event cancelled.
invoice.sentInvoice sent to recipient.
invoice.paidInvoice marked as paid.
invoice.disputedInvoice dispute raised.
invoice.cancelledInvoice cancelled.
availability.updatedAllotment or availability data changed.

Delivery attempts are logged in WebhookDelivery records. Failed deliveries are retried with exponential backoff. Each delivery record stores the response code, response body, attempt count, and next retry timestamp.

Webhook Endpoints

MethodPathDescription
GET/api/dev/integrations/webhooks/List all registered webhook endpoints.
POST/api/dev/integrations/webhooks/Register a new webhook endpoint.
GET/PUT/DELETE/api/dev/integrations/webhooks/{id}/Retrieve, update, or delete a webhook endpoint.
POST/api/dev/integrations/webhooks/{id}/test/Send a test ping event to the endpoint.
GET/api/dev/integrations/webhooks/{id}/deliveries/List recent delivery attempts for an endpoint.
POST/api/dev/integrations/webhooks/deliveries/{id}/retry/Manually retry a failed delivery.

Data Exports

The Export Center generates bulk data files in multiple formats. An export request is created asynchronously — a Celery task processes the request and stores the resulting file.

FieldOptions
formatjson | xml_ota | octo | csv | xero | quickbooks
scopefacts | photos | stopsale | invoices
statuspending | processing | done | failed
filtersJSON of scope-specific filters (date range, property IDs, etc.).
fileFile path once export is complete — download via the list endpoint.
MethodPathDescription
GET/api/dev/integrations/exports/List past export requests with download links.
POST/api/dev/integrations/exports/create/Queue a new export request. Body: {format, scope, filters}.

Usage Statistics

API usage is tracked in the APIStats model (reports app) per token per endpoint per day. The statistics dashboard provides per-token breakdowns with ApexCharts visualisations: total hits, successful hits, errors, bytes transferred, and active tokens over time. A pre-aggregated APIStatsSummary model powers fast dashboard reads without querying the raw stats table.

Monitoring key usage

Use the statistics dashboard to spot unusual spikes or errors per API key — an error rate above 5% usually indicates a misconfigured partner integration.

Sub-User Access

Sub-users require developer_tools = True in UserPermission to access any Developer Tools endpoint. Without this flag all dev tools API calls return HTTP 403.