Enquiries & requests

A few endpoints for working with enquiries - the requests guests lodge when the automated booking flow can’t seat them (an oversized party, or no availability), and that your team works from the Requests inbox. See Enquiries & requests for the full guest and operator flow, including the request’s chat. Every endpoint is under /api/my-venues/:venueId/enquiries/:id/… and is operator (client role, venue-scoped) - send an Authorization: Bearer token from the Authentication flow.

Endpoints

Method	Path	Purpose	Auth
GET	/api/my-venues/:venueId/enquiries/:id/history	Read a request’s lifecycle timeline	operator
POST	/api/my-venues/:venueId/enquiries/:id/comments	Set a staff-only internal note	operator
POST	/api/my-venues/:venueId/enquiries/:id/reassign-guest	Attach a different guest to a request	operator
POST	/api/my-venues/:venueId/enquiries/:id/restore	Restore a trashed request	operator

Read a request’s history

GET .../enquiries/:id/history returns the request’s lifecycle as an events array (newest first) - created, read, tagged, a guest reply reopening it, booked, declined, expired, or restored - each with an at timestamp, the actor who did it (when there is one), and a short, already human-readable details string.

cURL

curl "https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/history" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN"

JavaScript

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/history",
  { headers: { Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}` } },
);
const data = await res.json();

PHP

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/history");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
]);
$data = json_decode(curl_exec($ch), true);

{
  "events": [
    { "at": "2026-06-20T18:04:00Z", "type": "read", "actor": null, "details": null },
    { "at": "2026-06-20T18:00:00Z", "type": "created", "actor": null, "details": "via booking widget" }
  ]
}

This works on a trashed request too, so you can still review how it got there.

Set a staff-only note

POST .../enquiries/:id/comments sets the request’s internal note - visible to your team only, never to the guest. Send comments (up to 4,000 characters); an empty string clears it.

cURL

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/comments" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"comments":"Regular guest, prefers a window table."}'

JavaScript

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/comments",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ comments: "Regular guest, prefers a window table." }),
  },
);
const data = await res.json();

PHP

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/comments");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode(["comments" => "Regular guest, prefers a window table."]),
]);
$data = json_decode(curl_exec($ch), true);

{ "ok": true, "comments": "Regular guest, prefers a window table." }

Reassign the guest

POST .../enquiries/:id/reassign-guest attaches a different guest to a request - pass a user_id for one of your own guests, or guest_name (with an optional guest_phone) for a walk-in with no account. A bare call with neither is rejected - a request is never left without a guest.

cURL

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/reassign-guest" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"user_id":"usr_def"}'

JavaScript

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/reassign-guest",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ user_id: "usr_def" }),
  },
);
const data = await res.json();

PHP

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/reassign-guest");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode(["user_id" => "usr_def"]),
]);
$data = json_decode(curl_exec($ch), true);

{ "ok": true }

Restore a trashed request

POST .../enquiries/:id/restore clears a request’s trash flag, returning it to the list with the status it had when it was trashed. It returns a 409 if the request isn’t currently trashed.

cURL

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/restore" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN"

JavaScript

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/restore",
  { method: "POST", headers: { Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}` } },
);
const data = await res.json();

PHP

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/enquiries/enq_1/restore");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
]);
$data = json_decode(curl_exec($ch), true);

{ "ok": true, "status": "pending" }