Access profiles, admission rules & policies

Reusable building blocks that access rules and events reference. Access profiles package a bundle of booking settings so several access rules share them; admission groups + rules apply conditional discounts and auto-approval to the guest list; policies hold booking terms and deposit/refund rules. Every endpoint is under /api/my-venues/:venueId/… and is operator (client role, venue-scoped) - send an Authorization: Bearer token from the Authentication flow.

Method	Path	Purpose	Auth
GET/POST	`/api/my-venues/:venueId/list-profiles`	Guest-list profiles	operator
PUT/DELETE	`/api/my-venues/:venueId/list-profiles/:id`	Update/delete	operator
GET	`/api/my-venues/:venueId/list-profiles/default`	The venue’s default guest-list profile	operator
GET/POST	`/api/my-venues/:venueId/table-profiles`	Table profiles	operator
PUT/DELETE	`/api/my-venues/:venueId/table-profiles/:id`	Update/delete	operator
POST	`/api/my-venues/:venueId/table-profiles/:id/image`	Experience hero image	operator
GET	`/api/my-venues/:venueId/table-profiles/default`	The venue’s default table profile	operator
GET/POST	`/api/my-venues/:venueId/event-profiles`	Event profiles	operator
PUT/DELETE	`/api/my-venues/:venueId/event-profiles/:id`	Update/delete	operator
GET	`/api/my-venues/:venueId/event-profiles/default`	The venue’s default event profile	operator
GET/POST	`/api/my-venues/:venueId/ticket-profiles`	Ticket profiles	operator
PUT/DELETE	`/api/my-venues/:venueId/ticket-profiles/:id`	Update/delete	operator
GET	`/api/my-venues/:venueId/ticket-profiles/default`	The venue’s default ticket profile	operator
GET/POST	`/api/my-venues/:venueId/admission-groups`	Admission groups	operator
PUT/DELETE	`/api/my-venues/:venueId/admission-groups/:gid`	Update/delete group	operator
POST	`/api/my-venues/:venueId/admission-groups/:gid/rules`	Add rule	operator
PUT/DELETE	`/api/my-venues/:venueId/admission-groups/:gid/rules/:id`	Update/delete rule	operator
GET/PUT	`/api/my-venues/:venueId/booking-policies`	Booking policy text	operator
GET/POST	`/api/my-venues/:venueId/payment-policies`	Payment policies	operator
PUT/DELETE	`/api/my-venues/:venueId/payment-policies/:id`	Update/delete	operator
GET/POST	`/api/my-venues/:venueId/deposit-policies`	Deposit (auto-cancel) policies	operator
PUT/DELETE	`/api/my-venues/:venueId/deposit-policies/:id`	Update/delete	operator
GET/POST	`/api/my-venues/:venueId/confirmation-policies`	Confirmation policies	operator
PUT/DELETE	`/api/my-venues/:venueId/confirmation-policies/:id`	Update/delete	operator

Access profiles

The four families share one CRUD shape: GET lists, POST creates (returns { success, id }), PUT /:id updates, DELETE /:id removes. name is required on every create/update. They differ in the settings they carry:

list-profiles - guest-list pricing and admission: venue_access_*, free_guest_list_*, paid_guest_list_*, queue_skip_price_*, surge_threshold_*, surge_price_*, party_size_*, booking window, max_covers_*, admission_rule_group_id to attach an admission group, payment_policy_id, the booking-policy text (booking_policy_type with booking_policy_custom), and the checkout hold (hold_enabled with hold_minutes, 1-30).
table-profiles - table booking: party_size_*, seating_enabled with seating_area_ids/table_ids, payment_policy_id, the booking-policy text (booking_policy_type with booking_policy_custom), duration, add-ons (bundles_enabled/bundle_ids) and pre-order (preorder_enabled/ preorder_bundle_ids, each ordered the way guests will see the bundles) each with a *_pay_at_venue toggle, reservation_tags, booking window, max_covers_*, table_assignment_mode (auto|guest_pick|guest_pick_area) with guest_pick_area_ids, pricelist_id with pricelist_min_party, waitlist_enabled, deposit_policy_id and confirmation_policy_id (see the policy sections below), the late/no-show controls (noshow_auto_mark, late_threshold_mins, cancel_threshold_mins), the checkout hold (hold_enabled/hold_minutes), and show_as_experience with its guest-facing branding (experience_title, experience_description, experience_image_url). table_assignment_mode chooses how a table is assigned: auto (Sidedoor picks), guest_pick (the guest chooses any table), or guest_pick_area (the guest chooses an area, from guest_pick_area_ids, and Sidedoor picks a table within it). guest_pick_area_ids holds seating-area ids and/or "group:<groupId>" entries for seating area groups; a group entry lets the guest pick any of its areas. An empty list offers every group plus every ungrouped area.
event-profiles - event booking: payment_policy_id, the booking-policy text (booking_policy_type/booking_policy_custom), booking window, bundle_ids, reservation_tags, promo_code_ids, visibility and listed.
ticket-profiles - ticket booking: booking window, visibility, booking_tags, show_capacity, and the checkout hold (hold_enabled/ hold_minutes).

Each feature has an *_enabled toggle; a value only applies when its toggle is true, otherwise the venue default is used.

The default profile

Each of the four families has one hidden default profile per venue - the universal fallback used wherever no specific profile is attached. It never appears in GET list results (which only return the venue’s own, nameable profiles) and can’t be renamed, but you read and update it like any other: GET .../list-profiles/default, .../table-profiles/default, .../event-profiles/default and .../ticket-profiles/default each return that family’s default profile as data (or null if the venue has none yet); save changes to it with the normal PUT .../:id using its own id.

curl "https://thesidedoor.co/api/my-venues/VENUE_ID/table-profiles/default" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN"

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/table-profiles/default",
  { headers: { Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}` } },
);
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/table-profiles/default");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer {$token}"],
]);
$data = json_decode(curl_exec($ch), true);

{ "data": { "id": "tp_default", "name": "Default", "is_default": 1, "party_size_enabled": false } }

Create a table profile

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/table-profiles" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Standard Table","party_size_enabled":true,"party_size_min":2,"party_size_max":8,"duration_enabled":true,"duration_minutes":120,"table_assignment_mode":"auto","payment_policy_id":"pp_std"}'

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/table-profiles",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: "Standard Table",
      party_size_enabled: true,
      party_size_min: 2,
      party_size_max: 8,
      duration_enabled: true,
      duration_minutes: 120,
      table_assignment_mode: "auto",
      payment_policy_id: "pp_std",
    }),
  },
);
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/table-profiles");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "name" => "Standard Table",
    "party_size_enabled" => true,
    "party_size_min" => 2,
    "party_size_max" => 8,
    "duration_enabled" => true,
    "duration_minutes" => 120,
    "table_assignment_mode" => "auto",
    "payment_policy_id" => "pp_std",
  ]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true, "id": "tp_std" }

Update with PUT /api/my-venues/:venueId/table-profiles/:id and delete with DELETE /api/my-venues/:venueId/table-profiles/:id (deleting also detaches the profile from any access rules that referenced it), each returning { "success": true }. The other three families work identically at their own paths.

When a table profile has show_as_experience on, set its guest-facing hero image with POST /api/my-venues/:venueId/table-profiles/:id/image. Send a JSON body { "data": "data:image/…" } (a base64 data URL, under 2MB); the response returns { "success": true, "url": "…" } and stores the URL on the profile’s experience_image_url.

Admission groups & rules

An admission group is a named container of rules; each rule tests conditions (guest tags, past bookings, network connections) and applies actions (a discount, auto-approval, an increased plus-one cap). Attach a group to a guest-list profile via its admission_rule_group_id.

Create a group

POST /api/my-venues/:venueId/admission-groups takes name (required) and an optional sort_order.

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/admission-groups" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Regulars","sort_order":0}'

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/admission-groups",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ name: "Regulars", sort_order: 0 }),
  },
);
const { id } = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/admission-groups");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode(["name" => "Regulars", "sort_order" => 0]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true, "id": "grp_reg" }

GET /api/my-venues/:venueId/admission-groups returns each group with a nested rules array.

Add a rule to a group

POST /api/my-venues/:venueId/admission-groups/:gid/rules. Each condition and action has an *_enabled toggle plus a typed value: cond_tags (array), cond_bookings_min, cond_connections_min, act_discount_pct, act_autoapprove_enabled (toggle only) and act_maxplus.

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/admission-groups/grp_reg/rules" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"VIP tag → 20% off + auto-approve","cond_tags_enabled":true,"cond_tags":["vip"],"act_discount_enabled":true,"act_discount_pct":20,"act_autoapprove_enabled":true,"act_maxplus_enabled":true,"act_maxplus":6}'

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/admission-groups/grp_reg/rules",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: "VIP tag → 20% off + auto-approve",
      cond_tags_enabled: true,
      cond_tags: ["vip"],
      act_discount_enabled: true,
      act_discount_pct: 20,
      act_autoapprove_enabled: true,
      act_maxplus_enabled: true,
      act_maxplus: 6,
    }),
  },
);
const data = await res.json();

$ch = curl_init(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/admission-groups/grp_reg/rules"
);
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "name" => "VIP tag → 20% off + auto-approve",
    "cond_tags_enabled" => true,
    "cond_tags" => ["vip"],
    "act_discount_enabled" => true,
    "act_discount_pct" => 20,
    "act_autoapprove_enabled" => true,
    "act_maxplus_enabled" => true,
    "act_maxplus" => 6,
  ]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true, "id": "arl_1" }

Update a rule with PUT .../admission-groups/:gid/rules/:id and delete it with DELETE .../admission-groups/:gid/rules/:id. Deleting a group also removes its rules and detaches it from any list profiles.

Booking policies

GET /api/my-venues/:venueId/booking-policies returns three free-text policy strings; PUT saves them. Empty strings clear a policy.

curl -X PUT "https://thesidedoor.co/api/my-venues/VENUE_ID/booking-policies" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tables":"48h cancellation notice.","guest_list":"Over-21s only.","events":"Tickets non-refundable."}'

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/booking-policies",
  {
    method: "PUT",
    headers: {
      Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      tables: "48h cancellation notice.",
      guest_list: "Over-21s only.",
      events: "Tickets non-refundable.",
    }),
  },
);
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/booking-policies");
curl_setopt_array($ch, [
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "tables" => "48h cancellation notice.",
    "guest_list" => "Over-21s only.",
    "events" => "Tickets non-refundable.",
  ]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true }

Payment policies

Payment policies hold deposit and refund terms; access rules, shifts and profiles reference them by id. POST /api/my-venues/:venueId/payment-policies creates one (name required). Fields: deposit_type (default hold), refund_type (default none), refund_percent (default 100), cancel_type (default anytime), cancel_cutoff_value (default 24) and cancel_cutoff_unit (default hours). Three more fields control what happens to a held deposit when a reservation is auto-cancelled: noshow_deposit_action (capture|release, default capture), confirmation_deposit_action (capture|release, default release), and noshow_capture_delay_mins (minutes to wait after the start time before capturing a no-show’s deposit, default 30). A venue’s default payment policy cannot be deleted.

Create a payment policy

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/payment-policies" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Standard Deposit","deposit_type":"hold","refund_type":"partial","refund_percent":50,"cancel_type":"cutoff","cancel_cutoff_value":24,"cancel_cutoff_unit":"hours"}'

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/payment-policies",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: "Standard Deposit",
      deposit_type: "hold",
      refund_type: "partial",
      refund_percent: 50,
      cancel_type: "cutoff",
      cancel_cutoff_value: 24,
      cancel_cutoff_unit: "hours",
    }),
  },
);
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/payment-policies");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "name" => "Standard Deposit",
    "deposit_type" => "hold",
    "refund_type" => "partial",
    "refund_percent" => 50,
    "cancel_type" => "cutoff",
    "cancel_cutoff_value" => 24,
    "cancel_cutoff_unit" => "hours",
  ]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true, "id": "pp_std" }

Update with PUT /api/my-venues/:venueId/payment-policies/:id and delete with DELETE /api/my-venues/:venueId/payment-policies/:id, each returning { "success": true }. For how holds are captured or released at check-in, see the operator guide on deposits and holds.

Deposit policies

A deposit policy is a reusable, named rule that auto-cancels a reservation whose deposit was requested but never paid, warning the guest first. Cancellation can run a set time before the reservation starts, a set time after the deposit was requested, or both, whichever comes first. A table profile picks one via its deposit_policy_id.

GET /api/my-venues/:venueId/deposit-policies lists them (default policy first); POST creates one (name required). Fields:

cancel_mode (default before; one of before, after_request, both) - which cancellation timing applies: a set time before the reservation starts, a set time after the deposit is requested, or both.
cancel_cutoff_value (default 24) and cancel_cutoff_unit (default hours; one of minutes, hours, days, weeks, months) - how long before the start an unpaid deposit auto-cancels the reservation. Used when cancel_mode is before or both.
after_request_value (default 24) and after_request_unit (default hours; same units) - how long after the deposit is requested an unpaid deposit auto-cancels it. Used when cancel_mode is after_request or both; a re-sent payment link restarts the clock, and a deadline landing on or after the reservation start is skipped for that booking.
notify_value (default 48) and notify_unit (same units) - when to warn the guest. The warning is mandatory and must be the shorter of the two: earlier than cancel_cutoff_value/cancel_cutoff_unit when cancel_mode is before, or shorter than after_request_value/after_request_unit otherwise. A mismatched value returns 400.
notify_sms (default off), notify_push (default on), notify_email (default on) - legacy per-policy channel flags, still recorded on the policy for backward compatibility. The channels the warning actually goes out on are now governed centrally by the venue’s notification settings (Settings → Notifications), not by these fields.

POST returns { "success": true, "id": "…" }.

Create a deposit policy

curl -X POST "https://thesidedoor.co/api/my-venues/VENUE_ID/deposit-policies" \
  -H "Authorization: Bearer $SIDEDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Standard","cancel_cutoff_value":24,"cancel_cutoff_unit":"hours","notify_value":48,"notify_unit":"hours","notify_email":true,"notify_push":true,"notify_sms":false}'

const res = await fetch(
  "https://thesidedoor.co/api/my-venues/VENUE_ID/deposit-policies",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.SIDEDOOR_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: "Standard",
      cancel_cutoff_value: 24,
      cancel_cutoff_unit: "hours",
      notify_value: 48,
      notify_unit: "hours",
      notify_email: true,
      notify_push: true,
      notify_sms: false,
    }),
  },
);
const data = await res.json();

$ch = curl_init("https://thesidedoor.co/api/my-venues/VENUE_ID/deposit-policies");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "name" => "Standard",
    "cancel_cutoff_value" => 24,
    "cancel_cutoff_unit" => "hours",
    "notify_value" => 48,
    "notify_unit" => "hours",
    "notify_email" => true,
    "notify_push" => true,
    "notify_sms" => false,
  ]),
]);
$data = json_decode(curl_exec($ch), true);

{ "success": true, "id": "dp_std" }

Update with PUT /api/my-venues/:venueId/deposit-policies/:id and delete with DELETE /api/my-venues/:venueId/deposit-policies/:id, each returning { "success": true }. Deleting also detaches the policy from any table profiles that referenced it. The venue’s default deposit policy cannot be deleted (it is still editable), so a delete on it returns 400.

Confirmation policies

A confirmation policy is the sibling of a deposit policy: instead of auto-cancelling an unpaid deposit, it asks the guest to actively reconfirm they are still coming and auto-releases the table if they do not by the deadline. A table profile picks one via its confirmation_policy_id. The fields, defaults, validation and CRUD shape are identical to deposit policies (cancel_cutoff_value/cancel_cutoff_unit, the mandatory notify_value/notify_unit, and notify_sms/notify_push/ notify_email), at /api/my-venues/:venueId/confirmation-policies and .../confirmation-policies/:id. The venue’s default confirmation policy cannot be deleted.