Webhooks and APIAPI

API

Let other apps read your trip, booking, and customer data from WP Travel Engine - securely and automatically.

 curl "https://yoursite.com/wp-json/wptravelengine/api/v1/bookings?
accesstoken=wte...&accesssecret=wtesec..."
curl -H "Access-Token: wteyourapikeyhere" \
         -H "Access-Secret: wtesecyoursecrethere" \
         "https://yoursite.com/wp-json/wptravelengine/api/v1/bookings"

Connect other apps to your booking data

The REST API lets other apps ask your website for data and get it back. Think of it like a librarian: another app asks for bookings or trips, and your site hands over the information. You do not have to export anything by hand.

Say you have a mobile app where travelers can see their booking history. The app uses the API to pull each traveler's bookings from your site. Or say you want to pull your booking data into a tool like Power BI to see your revenue at a glance. The API makes that possible.

Before you create an API key, check the Overview & Prerequisites page. You will need at least one API key and secret, the right permissions for that key, and optionally Postman if you want to test the connection.

Quick start

If the word API feels technical, do not worry. You only need to think of it as a way for another app to read information from your website.

What is a REST API? A REST API is a standard way for one app to ask another app for information over the web.

Real-world example: Say you run a 7-day Annapurna trek and want travelers to see their booking history in your mobile app. The app can use the API to ask your website for that booking data and show it to the traveler right away.

Generate API keys

This part gives the other app permission to read data from your site. An API key and secret work like login details for that app.

What you'll need before you start: access to your WordPress dashboard and permission to manage WP Travel Engine settings on the left sidebar.

Open the API Keys settings

This is where you create the login details another app will use.

In the left sidebar of your WordPress dashboard, go to WP Travel Engine, then Settings, then Webhooks & API, then API Keys.

Generate a new key

This creates a new set of access details for one connection.

Click Generate API Key. Choose the permissions you want this key to have. For example, you might allow access to bookings and trips but not customer details.

Copy the key and secret

You will need both pieces to connect another app.

Copy the Key and the Secret and save them somewhere safe. You will use them in Postman or give them to your developer or integration tool.

Save the key

This makes the new key active in your site.

Click Add API.

Once the key is saved, you are ready to test whether the connection works.

Testing the API with Postman

Postman is a testing tool that lets you send a request to your website and see the response. It is useful when you want to confirm your key works before connecting a mobile app, dashboard, or partner system.

Example: List all bookings

Quick testing (less secure)

This method is useful for a quick test. It is less secure because your key and secret are visible in the web address.

Postman steps:

Create a GET request

This tells Postman you want to read data from your site.

Open Postman. Click New, then HTTP Request. Set the method to GET.

Enter the endpoint URL

An endpoint is the web address for one type of data. In this case, it is the address for bookings.

Enter this URL without any extra values:

https://yoursite.com/wp-json/wptravelengine/api/v1/bookings

Add the credentials as params

This tells your website who is asking for the data.

Go to the Params tab and add:

KeyValue
Access-Tokenwte_example_9xmk7q2r
Access-Secretwtesec_example_4nzb8m1p

Send and review

This confirms whether your key works.

Click Send. If everything is correct, Postman shows a JSON response with booking data.

This method is not secure. Your API key and secret appear in the URL. URLs can show up in browser history, server logs, firewall logs, analytics tools, CDN logs, and reverse proxies. Use this only for quick testing, debugging, or non-production sites.

This is the better method for real use. Your credentials are sent in headers, which means they are not visible in the URL. A header is extra information sent with the request behind the scenes.

Required headers:

Access-Token: YOUR_API_KEY
Access-Secret: YOUR_API_SECRET

Postman steps:

Create a GET request

This starts a safe test using headers instead of the web address.

Open Postman, click New, then HTTP Request, and set the method to GET.

Enter the endpoint URL

This tells Postman which data you want to read.

https://yoursite.com/wp-json/wptravelengine/api/v1/bookings

Add the credentials as headers

This keeps your key and secret out of the URL.

Go to the Headers tab and add:

KeyValue
Access-TokenYOUR_API_KEY
Access-SecretYOUR_API_SECRET

Send and review

This shows whether the connection is working.

Click Send. If the setup is correct, Postman shows the JSON response with your bookings.

Use the params method only for quick testing or checking whether your key works. Use the headers method for anything secure, recommended, or production-facing.

Example: Retrieve a single trip

This test is helpful when you want to check one specific trip. For example, you might want to pull the details for your Everest Base Camp package into another system.

What you'll need before you start: the trip ID for the trip you want to test, plus your API key and secret.

Create a GET request

This starts a request for one trip instead of all bookings.

Open Postman and create a new GET request.

Enter the trip URL

This tells your site which trip you want to look up.

Replace trip_id with your real trip ID:

https://yoursite.com/wp-json/wptravelengine/api/v1/trips/{trip_id}

Add your credentials

This proves the request is allowed.

Go to Params or Headers, depending on the method you chose earlier, and add your Access-Token and Access-Secret.

Send and review

This confirms whether the trip can be fetched correctly.

Click Send. If everything is working, Postman shows the JSON response for that trip.

If you can see the trip details, your API connection is working and ready for the next tool.

Common ways tour businesses use the API

The API is most useful when you want another system to read data from WP Travel Engine without exporting spreadsheets by hand.

Internal dashboard or BI tool

You might want one place to see bookings, payments, and revenue across all your tours. That is helpful if you run a mix of day tours, treks, and seasonal departures.

Use the /bookings, /payments, and /trips endpoints to pull data into Power BI, Looker Studio, or Tableau. For example, you could build a dashboard that shows how your spring Annapurna departures are selling compared with your autumn departures.

Mobile app or customer portal

You may want travelers to log in and see their own booking details outside your main website. That could be a mobile app, a private customer area, or a partner-facing portal.

The API can pull booking history, trip details, and payment information from your site. For example, a traveler booked a family day tour with gear rental add-ons and wants to see the full booking later in your app.

Partner platform integration

Some tour businesses work with affiliates, agents, or partner platforms that need live trip information. Those partners may want to show available trips without asking you to send updates by email.

Use the /trips and /bookings endpoints to help sync trip details, availability, or departure information. For example, a regional travel partner could pull your fixed departure trek list so they can show current options to their customers.

Tips to share with your developer

If a developer is helping you connect the API to another system, these tips can help keep the connection fast and stable.

Use pagination with**perpage****.** This means pulling data in smaller batches instead of asking for everything at once. It helps if you have lots of bookings during busy seasons.

Cache responses on your end. A cache is a saved copy of recent data. It stops the other system from asking your website for the same information over and over.

Make large data pulls during quieter hours. If your developer needs to sync a lot of bookings, it is better to do that when your site is less busy.

Use the**search**** parameter to filter results before they leave your site.** This cuts down how much data has to move back and forth and makes results faster to load.

Troubleshooting

I don't see any bookings when I test the API

This usually comes down to booking compatibility. The API can only show booking details for bookings made after WP Travel Engine version 6.7.0, which uses the newer calculation system with Cart version 4.0 or later.

Check that Cart 4.0 or newer is installed and active on your site. Then check whether the bookings you are trying to view were created after that newer system was in place.

If older bookings do not appear, that is expected. Newer bookings should appear once the required version is active.

I get an Unauthorized error when testing

This means your site did not accept the login details sent with the request. In Postman, that usually means the key, the secret, or the permissions need attention.

Check that you copied the API key and secret exactly as shown. Then make sure the key is active and that it has permission for what you are trying to read, such as bookings or trips.

If you are unsure, test with the secure headers method first. You can also test with the /test endpoint to confirm the key itself is working before trying a larger request.

The booking data in my response looks incomplete

Incomplete booking details usually point to the same requirement as missing bookings. Full booking data depends on the newer Cart system.

Make sure Cart 4.0 or newer is installed and active. Also remember that bookings from older WP Travel Engine versions will not appear with the same level of detail through the API.

If you recently updated, test again with a newer booking. That gives you the clearest result.

I keep getting Too Many Requests errors

This means your site is receiving too many API requests in a short period. The technical error code for this is 429 Too Many Requests.

If this happens during testing, wait a bit and try again. If it keeps happening in a live integration, the other system is likely asking your site for data too often.

Tips for your developer:

  • Use exponential backoff so the app waits longer between retries after each failed request.
  • Cache API responses on the other system so it does not ask your website for the same data repeatedly.
  • Check the X-RateLimit-Reset header to see when requests can start again.
  • If the integration truly needs a higher limit, contact support and explain the use case.

Frequently asked questions

If you're still stuck or have a question we didn't cover, our support team is happy to help. Reach out at our support page and we'll get you sorted.