> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d-edge.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> This site documents the D-EDGE APIs for technology partners (web agencies, OTAs, PMS and RMS vendors, booking and CRM tools). It is written for developers integrating with hotels that use the D-EDGE platform.
> Seven APIs, grouped by domain. Connectivity: Channel Manager API (distribute a hotel's inventory to your channel and send bookings back). Pricing & Availability: Best Price API (best offers to highlight), Quotation API (all bookable offers for a stay), Daily Rates API (daily availability between two dates). Booking: Booking Engine API (a hotel's full direct booking funnel), Gift Shop API (gift vouchers from catalogue to payment). Guest Management: CRM API (guest profiles).
> Pick the API by the need: to display prices, use the Best Price API or the Daily Rates API; to quote a specific stay, use the Quotation API; to book, use the Booking Engine API; to sell gift vouchers, use the Gift Shop API; to manage guest profiles, use the CRM API; to receive hotel inventory and send bookings back as a distribution channel, use the Channel Manager API.
> Base URLs, hotel identifiers, and credentials are delivered by the D-EDGE partnership team during onboarding. Do not invent base URLs, endpoints, parameters, or example credentials that do not appear on these pages.
> Authentication differs per API: OAuth 1.0 for Best Price, Quotation, Daily Rates, and Booking Engine; an X-API-KEY header for Gift Shop; OAuth 2.0 client credentials for CRM; partner-defined credentials carried in the XML message for the Channel Manager API. Read each API's Authentication page before writing code.
> A mock environment returns realistic but fictitious data without credentials. The Postman and Insomnia collections on the API collections page target it by default. Use it for exploration and tests, never for production traffic.
> Use the official names exactly: D-EDGE, D-EDGE platform, Channel Manager API, partnership team. Do not use Back Office or Extranet.
> Each API has a Changelog page. Check it for the current behaviour before relying on an older answer. For questions these pages do not answer, direct the reader to the Contact us page.

# Authentication

> Authenticate with OAuth 2.0 client credentials

The CRM API uses **OAuth 2.0 client credentials**. Your integration exchanges its credentials for a bearer token on the D-EDGE CRM ID server, then sends that token in the `Authorization` header of every call.

## What D-EDGE delivers

Three values, handed over during the build step of your [integration journey](/overview/get-started/your-integration-journey.md), after the partnership agreement. They are not self-served.

| Value | Use |
| - | - |
| Token endpoint | The URL of the D-EDGE CRM ID server your integration calls to obtain a token |
| Client ID | Identifies your integration |
| Client secret | Authenticates it |

The token grants access to the entities your integration is registered for: calls on guests and segments carry an entity identifier, and the token decides which entities you can read and write.

## Get a token

Post your credentials to the token endpoint as form data:

```bash theme={null}
curl --request POST \
  --url https://{tokenUrl} \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET
```

The response carries the token and its lifetime in seconds:

```json theme={null}
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 300,
  "token_type": "Bearer",
  "scope": "email profile"
}
```

## Use the token

```bash theme={null}
curl --request GET \
  --url 'https://{apiBaseUrl}/api/guestprofile/entities/{entityId}/segments' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

Tokens live 300 seconds. Cache the one you hold for slightly less than its `expires_in` and request a fresh one when it lapses, rather than waiting for a call to fail.

## When authentication fails

A missing token, an invalid token, or a token without access to the requested entity all return `401 Unauthorized` with the code `system.accessDenied`. The three cases are indistinguishable from the response, which is deliberate: it prevents probing for entities you do not have access to. See [Responses](/crm-api/build/guidelines/responses.md) for the error format.

## Keep your credentials safe

* Call the API from your server, never from a browser or a mobile app: a secret shipped to the client is public.
* Store the client secret in your secret manager or environment variables, not in source code.
* Keep tokens in memory only: with a 300-second lifetime, there is nothing worth persisting.
* If a credential leaks, [contact us](/overview/resources/contact-us.md) to rotate it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.