The Lockii API is how other software talks to a Lockii account. The same company is available as a REST API, as MCP servers for AI clients, and through OAuth when an operator connects an app.
https://dash.lockii.app/api/v1Staging uses https://staging.lockii.app/api/v1.
The OpenAPI document is public. No key is required:
GET https://dash.lockii.app/api/v1/openapi.jsonGET, each field is a query parameter. Objects and arrays on a GET are JSON strings. Other methods take a JSON body. A path parameter overrides a body field with the same name.stockID and companyID. The public Booking API uses company_id, start_time, and end_time.Settings → Integrations → API, then send it as the x-api-key header, as Authorization: Bearer, or as the api_key query parameter. Each key is limited to that company.Authorization: Bearer. The call runs as the signed-in user, or as the app connection, and only with the scopes that were granted.{ "error": { "code", "message" } } with 401 or 403. unauthorized, token_expired, and token_invalid are 401. connection_paused and insufficient_scope are 403. A request the handler rejects returns { "error", "message" } with 400.The Booking API is public and does not take a key. Marketplace channel calls use
/api/v1/channeland a marketplace app token.
| Surface | What it is |
|---|---|
| REST API | Server-to-server access to the company. This is the base URL above. |
| User MCP | Claude, Cursor, ChatGPT, VS Code, and other MCP clients working in the account. Server URL https://dash.lockii.app/api/mcp/user. Sign in with Lockii, or send an API key. Configured from Settings → Integrations → User MCP. |
| Customer MCP | A smaller tool set for support agents such as Intercom Fin: public inventory, a checkout link, and booking lookup. Server URL https://dash.lockii.app/api/mcp/customer. Configured from Settings → Integrations → Customer Support MCP. |
| Booking API | Public products, locations, availability, time slots, and checkout. No API key. |
| Login with Lockii | OAuth for the REST API and the User MCP. The integration acts as the signed-in user, with that user's role and location permissions. |
| Lockii app | A product operators connect from Settings → Integrations. Your servers get company-scoped offline tokens for the scopes they approved. |
| Marketplace app | An OTA or marketplace. Operators publish listings. You check availability, price the hire with Lockii, take payment, and create the booking. Signed webhooks keep listings and bookings in sync. |
| OpenAPI | The machine-readable spec at /api/v1/openapi.json, generated from the same definitions as the handlers. |
Operator REST resources:
| Area | Highlights |
|---|---|
| Bookings | Search and fetch a booking, manual pickup and return, change requests, payment links, refunds, marketplace import |
| Customers | Create, update, search, block, identity verification, revenue recovery, coupons |
| Catalog | Products, categories, collections, blog posts, pricing templates, a price calculation |
| Fleet | Stock, locations, locks, trackers |
| Maintenance | Work orders, parts, inspections, issue reports, meters and readings |
| Inbox and reports | Notifications, and a report query for bookings, demand, products, stock, and customers |
| Comments | Notes on records, and the support knowledge base |
Webhooks belong to a Lockii app or a marketplace app. Lockii signs each delivery. They are not a separate subscribe-in-the-dashboard product on the operator API.
List locations with the key. A 200 means the key is valid and returns the locations that company can see.
curl -H "x-api-key: <your-api-key>" \
https://dash.lockii.app/api/v1/locationA rejected key looks like this:
{
"error": {
"code": "unauthorized",
"message": "Unauthorized"
}
}Mint or rotate the key in Settings → Integrations → API. The full key is shown once.