Kết nối hệ thống của bạn với PMS GoHost qua API

curl "https://platform.gohost.vn/pms/api/public/v1/properties/{tenant_id}/room_types/search?checkin_date=2026-12-24&checkout_date=2026-12-26" \
  -H "Authorization: Bearer <api_key>:<api_secret>" \
  -H "Accept: application/json"

const res = await fetch(
  `https://platform.gohost.vn/pms/api/public/v1/properties/${tenantId}/room_types/search?checkin_date=2026-12-24&checkout_date=2026-12-26`,
  { headers: { Authorization: `Bearer ${apiKey}:${apiSecret}` } }
);
const { data } = await res.json();

$res = Http::withToken("{$apiKey}:{$apiSecret}")
    ->get("https://platform.gohost.vn/pms/api/public/v1/properties/{$tenantId}/room_types/search", [
        'checkin_date'  => '2026-12-24',
        'checkout_date' => '2026-12-26',
    ]);

$roomTypes = $res->json('data');

{
  "data": [
    {
      "room_types": {
        "id": "…",
        "title": "Deluxe Hướng Biển",
        "quantity": 3,
        "rate_plans": [
          {
            "id": "…",
            "title": "Gồm bữa sáng",
            "currency": "VND",
            "has_breakfast": true,
            "days_breakdown": [
              { "day": "2026-12-24", "price": 1700000 },
              { "day": "2026-12-25", "price": 1700000 }
            ],
            "estimated_total_price": 3400000
          }
        ]
      }
    }
  ]
}

curl -X POST "https://platform.gohost.vn/pms/api/public/v1/properties/{tenant_id}/bookings" \
  -H "Authorization: Bearer <api_key>:<api_secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "checkin_date": "2026-12-24",
    "checkout_date": "2026-12-26",
    "source_name": "website",
    "customer": { "name": "Khách Mẫu" },
    "booking_rooms": [{ "room_type_id": "…", "rate_plan_id": "…" }]
  }'

const res = await fetch(`https://platform.gohost.vn/pms/api/public/v1/properties/${tenantId}/bookings`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${apiKey}:${apiSecret}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    checkin_date: "2026-12-24",
    checkout_date: "2026-12-26",
    source_name: "website", // lấy từ GET /booking-sources
    customer: { name: "Khách Mẫu" },
    booking_rooms: [{ room_type_id: "…", rate_plan_id: "…" }],
  }),
});

$res = Http::withToken("{$apiKey}:{$apiSecret}")
    ->post("https://platform.gohost.vn/pms/api/public/v1/properties/{$tenantId}/bookings", [
        'checkin_date'  => '2026-12-24',
        'checkout_date' => '2026-12-26',
        'source_name'   => 'website', // lấy từ GET /booking-sources
        'customer'      => ['name' => 'Khách Mẫu'],
        'booking_rooms' => [['room_type_id' => '…', 'rate_plan_id' => '…']],
    ]);

Booking tạo qua API được ghi là đặt trực tiếp.
Booking chưa có thanh toán sẽ tự huỷ sau 16 phút:
ghi nhận thanh toán bằng POST /bookings/{id}/payments
hoặc xác nhận bằng POST /bookings/{id}/confirm.

# GoHost gửi tới URL HTTPS của bạn:
POST https://your-app.example/webhooks/gohost
X-Gohost-Event: booking.created
X-Gohost-Event-Id: evt_…
X-Gohost-Timestamp: 1767225600
X-Gohost-Signature: t=1767225600,v1=…

import crypto from "node:crypto";

// header = X-Gohost-Signature, dạng "t=<unix>,v1=<hex>"
function verify(rawBody, header, secret) {
  const m = /t=(\d+),v1=([a-f0-9]+)/.exec(header || "");
  if (!m || Math.abs(Date.now() / 1000 - Number(m[1])) > 300) return false;
  const expected = crypto.createHmac("sha256", secret)
    .update(`${m[1]}.${rawBody}`).digest("hex");
  return expected.length === m[2].length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(m[2]));
}

// X-Gohost-Signature có dạng "t=<unix>,v1=<hex>", ký trên "<t>.<raw body>"
preg_match('/t=(\d+),v1=([a-f0-9]+)/', (string) $request->header('X-Gohost-Signature'), $m);

if (! $m || abs(time() - (int) $m[1]) > 300
    || ! hash_equals(hash_hmac('sha256', $m[1].'.'.$request->getContent(), $secret), $m[2])) {
    abort(401);
}
// Dùng X-Gohost-Event-Id để bỏ qua sự kiện trùng

booking.created     booking.updated
booking.confirmed   booking.cancelled
booking.checked_in  booking.checked_out