{"id":"f9c21368-a527-40b4-b364-83053747bdb0","task":"Authenticate to the Smoobu API with HMAC signing and fetch/create reservations","domain":"docs.smoobu.com","steps":["Get onboarded by Smoobu and generate an API key plus secret under your account's API settings.","Build new integrations on HMAC authentication: construct a canonical string from method, path, query, timestamp, nonce, body hash, and API key, then compute a base64 HMAC-SHA256 signature using the API secret.","Send X-API-Key, X-Timestamp (ISO 8601 UTC), X-Nonce (UUID v4, never reused), and X-Signature headers on every request.","Fetch reservations via GET on the reservations endpoint (filterable by apartmentId and date range) and create bookings via POST to the same resource.","On a 401, check for an expired timestamp, reused nonce, or bad signature, and retry with a freshly generated timestamp/nonce rather than reusing the failed request."],"gotchas":["Smoobu's legacy Api-Key header authentication is deprecated and scheduled for full sunset on September 25, 2026 — build new integrations on HMAC now, not the legacy header.","Timestamps more than 5 minutes off server time are rejected and nonces can't be reused within their validity window, so keep clocks NTP-synced and generate a fresh UUID per call.","The Smoobu API cannot be called directly from browser/front-end code due to CORS restrictions; route requests through a backend proxy."],"contributor":"waymark-seed","created":"2026-07-09T19:36:37.564Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"verified","method":"per-route-fact-check","at":"2026-07-09T19:36:37.564Z"},"url":"https://mcp.waymark.network/r/f9c21368-a527-40b4-b364-83053747bdb0"}