{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/duffel.json", "name": "Duffel Flights and Stays API", "score": 66.7, "shared": [ "travel.stays", "travel.booking", "travel.changes", "travel.search" ], "slug": "duffel" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/letsfg.json", "name": "LetsFG", "score": 64, "shared": [ "travel.stays", "travel.booking", "travel.changes", "travel.search" ], "slug": "letsfg" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/liteapi.json", "name": "LiteAPI (Nuitee Connect)", "score": 53.1, "shared": [ "travel.stays", "travel.booking", "travel.changes", "travel.search" ], "slug": "liteapi" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/travelport.json", "name": "Travelport TripServices APIs", "score": 45.9, "shared": [ "travel.stays", "travel.booking", "travel.changes", "travel.search" ], "slug": "travelport" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/expedia-rapid.json", "name": "Expedia Group Rapid API", "score": 42.8, "shared": [ "travel.stays", "travel.booking", "travel.changes", "travel.search" ], "slug": "expedia-rapid" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/booking-demand-api.json", "name": "Booking.com Demand API", "score": 38.1, "shared": [ "travel.stays", "travel.booking", "travel.changes", "travel.search" ], "slug": "booking-demand-api" } ], "tool": { "slug": "ratehawk", "name": "ETG API (RateHawk)", "vendor": "Emerging Travel Group", "vendorUrl": "https://www.ratehawk.com", "kind": "http-api", "category": "travel", "summary": "Hotel search and booking API from Emerging Travel Group, the company behind RateHawk and ZenHotels. Contracted partners search rates, prebook, book and cancel stays over REST, with B2B, Affiliate and Content APIs.", "url": "https://www.anchorterminal.com/tools/ratehawk", "markdownUrl": "https://www.anchorterminal.com/tools/ratehawk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ratehawk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ratehawk.json", "repo": "https://github.com/EmergingTravel/papi-sdk-python", "license": "Proprietary service under a signed partner agreement that is not published. The Python and PHP SDKs on GitHub are MIT", "transports": [ "http" ], "remoteUrl": "https://api.ratehawk.com", "packages": [ { "registry": "pypi", "name": "papi-sdk" } ], "auth": "api-key", "authNotes": "Access is by partner approval. A person registers at ratehawk.com/registration, picks API integration as the purpose, then asks an account manager for credentials, and the docs say the relevant agreement must be signed before the API is used. Keys are `\u003cKEY_ID\u003e:\u003cAPI_KEY\u003e` pairs sent as HTTP Basic auth, issued separately for sandbox, test and production. A production key follows a written certification that the docs put at 14 to 30 days. Each key has its own endpoint permissions and request limits, readable at `/api/b2b/v3/overview/`.", "pricing": "byo-plan", "pricingNotes": "No public price list. Partners buy at net rates under contract and pay from a deposit with a credit limit, at the hotel or by card, depending on the rate. The landing page calls the API key free, and the sandbox makes no real bookings or charges, but a key comes from an account manager after registration, so an agent cannot start without a person and an agreement (checked 2026-10-08).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the Swagger file or the API landing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 9, "npmWeekly": null, "pypiWeekly": 12, "asOf": "2026-10-08" }, "docsUrl": "https://docs.emergingtravel.com/", "llmsTxt": "https://docs.emergingtravel.com/llms.txt", "openapi": "https://api.ratehawk.com/openapi.json", "capabilities": [ "travel.stays", "travel.booking", "travel.changes", "travel.search" ], "tags": [ "hosted", "closed-source", "openapi", "llms-txt", "sandbox", "sales-led", "certification", "status-page", "python", "php", "eu" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 53, "grade": "D", "agentReady": false, "rank": 554, "ranked": true, "rankOf": 722, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 65, "payments": 10, "reliability": 45, "schema": 85, "security": 41, "transparency": 56 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 45, "points": 9, "reason": "Graded as a hosted API. status.emergingtravel.com is a Better Stack page with nine monitors and 90 days of daily history, but its API monitors are named for the deprecated worldota.net hosts and it carries no written incident reports (15 of 20). The orders monitor recorded downtime of 6.9 hours on 21 July 2026, 2.4 hours on 24 July, 3.0 hours on 28 July and 1.3 hours on 14 September, and five other monitors show the 21 July outage, so we read several major outages (0 of 30). Request limits are per endpoint and per key, shown in four response headers and the overview call, with numbers only as examples (8 of 15). A 429 answers `endpoint_exceeded_limit` with the reset time, the docs say to retry 5xx with a cap on repeats, and `partner_order_id` makes booking retries safe, with no backoff guidance (12 of 15). No SLA found (0). Version 3 is generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 85, "points": 13.81, "reason": "A public Swagger 2.0 file covers the B2B and Content APIs with 48 operations and 171 definitions. It lists only a 200 response per operation and leaves out the Affiliate API (20 of 25). `llms.txt` and a Markdown copy of each page at `index.md` (10). Pages state each call's purpose, which calls are required and where a call should not be used, such as choosing rates from search results (16 of 20). Fields are typed and marked required, with five enums in the spec and GET calls that take JSON in a `data` query parameter (10 of 15). Each call page has sandbox and production examples and a list of error slugs, and the sandbox reproduces named errors (14 of 15). Version in the path and a changelog with 64 dated entries in 2026 (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 69, "points": 11.21, "reason": "Search takes `hotels_limit`, a `timeout` and filters, and static content comes as dumps, but there is no field selection and booking responses are long (15 of 25). Bookings are paged with `page_size` and `page_number`, search is filtered by stars, kind, meal and price, with no paging in search (14 of 20). Errors are short slugs with a `debug` object naming the endpoint, limits and validation error, each documented with what to do next (18 of 20). `partner_order_id` identifies a booking, `lock` and `double_booking_finish` reject duplicates, and the docs give retry rules for booking and cancellation (16 of 20). A booking takes at least five calls, and the Python and PHP SDKs date from 2021 and point at the deprecated host (6 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 41, "points": 7.18, "reason": "HTTP Basic keys, separate for sandbox, test and production and per contract, never in the URL. No scopes, and no rotation or revocation procedure was found in the docs (20 of 30). Endpoint permissions are set per key by the account manager, a host or IP allowlist exists (`not_allowed_host`), and the sandbox makes no real bookings, with no confirmation step for cancellation (10 of 20). Hotel descriptions and guest reviews are third-party text and the docs give no injection guidance (3 of 15). Every response carries a `request_id` and bookings can be listed, with no operator log view documented (4 of 15). Card tokenisation is described as PCI DSS and booking webhooks carry an HMAC signature. No `security.txt`, disclosure policy, bug bounty or certification page was found (4 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 10, "points": 1.25, "reason": "No x402, MPP or L402 (0). No public price list, with net rates and limits set by contract (0). The landing page says the API key is free and the sandbox makes no charges, but a key comes from an account manager after registration and an agreement, so we give half (10 of 20). A person registers, requests keys and passes certification (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 65, "points": 5.69, "reason": "The changelog's latest entry is 5 October 2026 (30). It has 15 dated entries between 10 July and 5 October 2026 (20). A public changelog, a named API support team and an address for support, with no public forum or issue tracker for the API (10 of 15). The official SDKs exist but are stale. `papi-sdk` 1.1.1 dates from 19 January 2021 and the PHP SDK from June 2021, and both default to `api.worldota.net` (3 of 15). The SDK repositories have CI workflows and no commits since 2021 (2 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 56, "points": 4.9, "note": "editorial 32, provenance 80", "reason": "Closed service whose partner agreement is not published, so the terms an integrator accepts cannot be read in advance. The SDKs are MIT (5 of 30). The RateHawk privacy notice, version 1.0 of 8 May 2026, names nine group entities as controllers and says data is kept until the purpose is achieved, with no periods and no DPA found (12 of 30). Deprecations appear as dated changelog entries with no stated policy, and the old sandbox host was given six days' notice on 24 June 2026 (10 of 20). Recipients are described by type, with no sub-processor list or data locations (5 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Search takes `hotels_limit`, a `timeout` and filters, and static content comes as dumps, but there is no field selection and booking responses are long (15 of 25). Bookings are paged with `page_size` and `page_number`, search is filtered by stars, kind, meal and price, with no paging in search (14 of 20). Errors are short slugs with a `debug` object naming the endpoint, limits and validation error, each documented with what to do next (18 of 20). `partner_order_id` identifies a booking, `lock` and `double_booking_finish` reject duplicates, and the docs give retry rules for booking and cancellation (16 of 20). A booking takes at least five calls, and the Python and PHP SDKs date from 2021 and point at the deprecated host (6 of 15).", "maintenance": "The changelog's latest entry is 5 October 2026 (30). It has 15 dated entries between 10 July and 5 October 2026 (20). A public changelog, a named API support team and an address for support, with no public forum or issue tracker for the API (10 of 15). The official SDKs exist but are stale. `papi-sdk` 1.1.1 dates from 19 January 2021 and the PHP SDK from June 2021, and both default to `api.worldota.net` (3 of 15). The SDK repositories have CI workflows and no commits since 2021 (2 of 10).", "payments": "No x402, MPP or L402 (0). No public price list, with net rates and limits set by contract (0). The landing page says the API key is free and the sandbox makes no charges, but a key comes from an account manager after registration and an agreement, so we give half (10 of 20). A person registers, requests keys and passes certification (0).", "reliability": "Graded as a hosted API. status.emergingtravel.com is a Better Stack page with nine monitors and 90 days of daily history, but its API monitors are named for the deprecated worldota.net hosts and it carries no written incident reports (15 of 20). The orders monitor recorded downtime of 6.9 hours on 21 July 2026, 2.4 hours on 24 July, 3.0 hours on 28 July and 1.3 hours on 14 September, and five other monitors show the 21 July outage, so we read several major outages (0 of 30). Request limits are per endpoint and per key, shown in four response headers and the overview call, with numbers only as examples (8 of 15). A 429 answers `endpoint_exceeded_limit` with the reset time, the docs say to retry 5xx with a cap on repeats, and `partner_order_id` makes booking retries safe, with no backoff guidance (12 of 15). No SLA found (0). Version 3 is generally available (10).", "schema": "A public Swagger 2.0 file covers the B2B and Content APIs with 48 operations and 171 definitions. It lists only a 200 response per operation and leaves out the Affiliate API (20 of 25). `llms.txt` and a Markdown copy of each page at `index.md` (10). Pages state each call's purpose, which calls are required and where a call should not be used, such as choosing rates from search results (16 of 20). Fields are typed and marked required, with five enums in the spec and GET calls that take JSON in a `data` query parameter (10 of 15). Each call page has sandbox and production examples and a list of error slugs, and the sandbox reproduces named errors (14 of 15). Version in the path and a changelog with 64 dated entries in 2026 (15).", "security": "HTTP Basic keys, separate for sandbox, test and production and per contract, never in the URL. No scopes, and no rotation or revocation procedure was found in the docs (20 of 30). Endpoint permissions are set per key by the account manager, a host or IP allowlist exists (`not_allowed_host`), and the sandbox makes no real bookings, with no confirmation step for cancellation (10 of 20). Hotel descriptions and guest reviews are third-party text and the docs give no injection guidance (3 of 15). Every response carries a `request_id` and bookings can be listed, with no operator log view documented (4 of 15). Card tokenisation is described as PCI DSS and booking webhooks carry an HMAC signature. No `security.txt`, disclosure policy, bug bounty or certification page was found (4 of 20).", "transparency": "Closed service whose partner agreement is not published, so the terms an integrator accepts cannot be read in advance. The SDKs are MIT (5 of 30). The RateHawk privacy notice, version 1.0 of 8 May 2026, names nine group entities as controllers and says data is kept until the purpose is achieved, with no periods and no DPA found (12 of 30). Deprecations appear as dated changelog entries with no stated policy, and the old sandbox host was given six days' notice on 24 June 2026 (10 of 20). Recipients are described by type, with no sub-processor list or data locations (5 of 20)." }, "sources": [ { "what": "docs home and llms.txt", "url": "https://docs.emergingtravel.com/llms.txt", "seen": "2026-10-08" }, { "what": "authorisation (hosts, key types, Basic auth)", "url": "https://docs.emergingtravel.com/docs/fundamentals/authorization/", "seen": "2026-10-08" }, { "what": "request limits", "url": "https://docs.emergingtravel.com/docs/fundamentals/request-limits/", "seen": "2026-10-08" }, { "what": "errors", "url": "https://docs.emergingtravel.com/docs/fundamentals/errors/", "seen": "2026-10-08" }, { "what": "sandbox", "url": "https://docs.emergingtravel.com/docs/fundamentals/sandbox/", "seen": "2026-10-08" }, { "what": "integration guide (registration, keys, Swagger link)", "url": "https://docs.emergingtravel.com/docs/integration-guide/", "seen": "2026-10-08" }, { "what": "certification and production access", "url": "https://docs.emergingtravel.com/docs/certification/", "seen": "2026-10-08" }, { "what": "changelog 2026, read as Markdown", "url": "https://docs.emergingtravel.com/docs/changelog/2026/index.md", "seen": "2026-10-08" }, { "what": "Swagger 2.0 file", "url": "https://api.ratehawk.com/openapi.json", "seen": "2026-10-08" }, { "what": "start booking process (payment types, errors, retries)", "url": "https://docs.emergingtravel.com/docs/b2b-api/booking/start-booking-process/", "seen": "2026-10-08" }, { "what": "booking status webhook (retries, signature)", "url": "https://docs.emergingtravel.com/docs/b2b-api/booking/receive-booking-status-webhook/", "seen": "2026-10-08" }, { "what": "credit card token call", "url": "https://docs.emergingtravel.com/docs/b2b-api/booking/create-credit-card-token/", "seen": "2026-10-08" }, { "what": "status page data, 90 days per monitor", "url": "https://status.emergingtravel.com/index.json", "seen": "2026-10-08" }, { "what": "status page incident list", "url": "https://status.emergingtravel.com/incidents", "seen": "2026-10-08" }, { "what": "API landing page", "url": "https://www.ratehawk.com/lp/en-us/API", "seen": "2026-10-08" }, { "what": "privacy notice", "url": "https://www.ratehawk.com/legal/site/privacy-policy/", "seen": "2026-10-08" }, { "what": "legal notice", "url": "https://www.ratehawk.com/legal/site/legal-notice/", "seen": "2026-10-08" }, { "what": "Python SDK repository", "url": "https://github.com/EmergingTravel/papi-sdk-python", "seen": "2026-10-08" }, { "what": "PHP SDK repository", "url": "https://github.com/EmergingTravel/papi-sdk-php", "seen": "2026-10-08" }, { "what": "PyPI record for papi-sdk", "url": "https://pypi.org/pypi/papi-sdk/json", "seen": "2026-10-08" }, { "what": "unauthenticated call, 401 with `no_auth_header`", "url": "https://api.ratehawk.com/api/b2b/v3/overview/", "seen": "2026-10-08" } ], "openQuestions": [ "The partner agreement's terms, including any SLA, data processing terms and limits on automated or AI use, are not public", "Whether the worldota.net production host still answers and on what date it stops, since the docs call it deprecated without a date", "Whether the status page's worldota.net monitors reflect the ratehawk.com API hosts", "Real request limits for a new sandbox or production key, since the docs show only examples", "How a partner rotates or revokes a key", "unchecked: the old docs site at docs-old.emergingtravel.com and the Postman collection were not read", "unchecked: security certifications of Emerging Travel Group beyond the PCI DSS statement on the card token page" ] }, "negative": 0, "verdict": "Hotel search and booking are documented in a public Swagger 2.0 file, an llms.txt index and a changelog with 64 dated entries in 2026. Access is by contract. Keys come from an account manager, production needs a certification of 14 to 30 days, and no price or API agreement is published.", "bestFor": "A travel company with an ETG contract that wants wholesale hotel rates behind its agent, with a documented sandbox for the build.", "strengths": [ "Public Swagger 2.0 file at `https://api.ratehawk.com/openapi.json` with 48 operations and 171 definitions for the B2B and Content APIs", "`llms.txt` and a Markdown copy of every docs page at `index.md`, with robots.txt allowing AI crawlers by name", "Changelog with 64 dated entries in 2026, the latest on 5 October 2026", "Sandbox host with over 2,000 test hotels, named error scenarios and no real bookings or charges", "`partner_order_id` identifies a booking across retries, and the docs say how to handle `timeout`, `unknown` and 5xx during booking" ], "weaknesses": [ "No self-serve key. Registration is followed by a request to an account manager, and the docs say an agreement must be signed before use", "No public price list or API agreement was found. Rates and request limits are set per contract", "The status page's orders monitor recorded downtime of an hour or more on four days between 21 July and 14 September 2026, with no written incident reports", "Both official SDKs (Python and PHP) last changed in 2021 and default to `api.worldota.net`, a host the docs call deprecated", "No `security.txt`, disclosure policy or security certification page was found on ratehawk.com, emergingtravel.com or the docs site" ], "agentNotes": [ "Call `/api/b2b/v3/overview/` first. It lists the endpoints the key may use and each one's request limit.", "Keep sandbox IDs, keys and hashes inside `api-sandbox.ratehawk.com`. Sandbox region IDs are limited to 2011, 2395, 2734 and 6053839.", "Run a prebook call before `booking/form`, then poll `booking/finish/status` until `ok` or a final error. Treat `timeout`, `unknown` and 5xx as still in progress.", "Send a new UUID as `partner_order_id` for each booking attempt and reuse it only to check or cancel that booking.", "A test key books hotel `hid` 8473727 as a real booking with real financial responsibility. Cancel it afterwards." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53 } ], "editorialScores": { "ergonomics": 69, "maintenance": 65, "payments": 10, "reliability": 45, "schema": 85, "security": 41, "transparency": 32 }, "provenanceScore": 80 }, "connect": { "http": "curl --user '\u003cKEY_ID\u003e:\u003cAPI_KEY\u003e' 'https://api-sandbox.ratehawk.com/api/b2b/v3/overview/'" }, "letme": { "capability": "https://letme.dev/travel.stays", "tool": "https://letme.dev/ratehawk" }, "notable": [ "The Swagger 2.0 file covers the B2B API and the Content API (48 operations, 171 definitions, Basic auth). The integration guide labels it B2B only, so the Affiliate API has no machine-readable contract (https://docs.emergingtravel.com/docs/integration-guide/)", "Three key types exist. Sandbox keys work on sample hotels with no real bookings, test keys book one test hotel (`hid` 8473727) with real financial responsibility, and production keys follow certification (https://docs.emergingtravel.com/docs/fundamentals/authorization/)", "Certification is in writing, takes about 14 to 30 days per product, and includes mandatory test cases, a pre-certification checklist and logs or site access for ETG's QA team (https://docs.emergingtravel.com/docs/certification/)", "The hosts moved from `api.worldota.net` and `api-sandbox.worldota.net` to ratehawk.com hosts. The changelog entry of 24 June 2026 said the old sandbox host would stop on 30 June 2026, six days later (https://docs.emergingtravel.com/docs/changelog/2026/)", "Request limits are per endpoint and per key, reported in `X-RateLimit-SecondsNumber`, `X-RateLimit-RequestsNumber`, `X-RateLimit-Remaining` and `X-RateLimit-Reset` response headers. Raising them needs approval after certification (https://docs.emergingtravel.com/docs/fundamentals/request-limits/)", "The status page runs on Better Stack with nine monitors. Its API monitors are named for the worldota.net hosts, and its incident list for August to October 2026 is empty while the monitors show downtime (https://status.emergingtravel.com/)", "Card data for pay-now rates goes to a separate tokenisation endpoint at `https://api.payota.net/api/public/v1/manage/init_partners`, which the docs describe as PCI DSS processing (https://docs.emergingtravel.com/docs/b2b-api/booking/create-credit-card-token/)", "The landing page claims 3.3M+ accommodations, 330+ suppliers and 220 countries and territories (https://www.ratehawk.com/lp/en-us/API)" ], "area": "domain-data", "details": [ { "label": "APIs", "value": "B2B API (search, prebook, booking, post-booking, documents, order groups, profiles, static dumps), Affiliate API, Content API (access on request, per the docs) and Midoffice webhooks, all version 3" }, { "label": "Hosts", "value": "`https://api.ratehawk.com` for test and production, `https://api-sandbox.ratehawk.com` for sandbox. The worldota.net hosts are deprecated" }, { "label": "Auth", "value": "HTTP Basic with `\u003cKEY_ID\u003e:\u003cAPI_KEY\u003e`. Sandbox, test and production keys, several production keys possible across contracts, visible only to the master account" }, { "label": "Going live", "value": "Register, request keys from an account manager, build against the sandbox, pass written certification (14 to 30 days), then complete the partnership paperwork for a production key" }, { "label": "Booking flow", "value": "Search by region, geo or hotel IDs, retrieve the hotel page, prebook, create the booking process, start it, then poll the check call or receive a signed webhook" }, { "label": "Payment types", "value": "`deposit` (drawn from the partner's ETG deposit under a credit limit), `hotel` (paid at the property) and `now` (card, with a token from api.payota.net and 3-D Secure)" }, { "label": "Rate limits", "value": "Per endpoint and per key, set by contract. The docs' examples show 10 requests a second and 1,000 a minute. A 429 answers `endpoint_exceeded_limit` with the reset time" }, { "label": "Sandbox", "value": "Over 2,000 test hotels plus named hotels for price rises, taxes and errors. Language fixed to `en`, at most five rates a hotel in search, no card or 3-D Secure flows" }, { "label": "Spec and docs", "value": "Swagger 2.0 for B2B and Content, a Postman collection, `llms.txt`, and each page as Markdown at `index.md`" }, { "label": "SDKs", "value": "`papi-sdk` for Python (1.1.1, 19 January 2021) and `emerging-travel/papi-sdk-php` (v0.0.4, June 2021), both MIT and both defaulting to `api.worldota.net`" }, { "label": "Status", "value": "status.emergingtravel.com on Better Stack, nine monitors with 90 days of daily history, no written incidents for August to October 2026" }, { "label": "MCP server", "value": "None found" } ], "provenance": { "legalEntity": "Leaside Services Limited", "domain": "ratehawk.com", "domainRegistered": "2006-08-24", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://www.ratehawk.com/legal/site/privacy-policy/", "statusPage": "https://status.emergingtravel.com", "changelog": "https://docs.emergingtravel.com/docs/changelog/2026/", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "No terms document for the API is published. The docs say the relevant agreement must be signed before use, and the only public terms we found are website terms of use on emergingtravel.com, so the terms field is left out.", "The RateHawk legal notice names Leaside Services Limited, a Cyprus company with registration number HE 342401, at Ifigeneias 17, Strovolos, Nicosia. The privacy notice (version 1.0, updated 8 May 2026) gives the same company an address in Limassol and lists eight other Emerging Travel entities as controllers by contract.", "The API answers at api.ratehawk.com and api-sandbox.ratehawk.com. Card tokenisation is at api.payota.net and the docs are at docs.emergingtravel.com, both outside ratehawk.com.", "`/.well-known/security.txt` returned 404 on www.ratehawk.com, api.ratehawk.com, www.emergingtravel.com and docs.emergingtravel.com.", "RDAP gives ratehawk.com a registration date of 2006-08-24 and emergingtravel.com 2007-02-25." ], "score": 80, "checks": [ { "check": "Legal entity named", "value": "Leaside Services Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "ratehawk.com, registered 2006-08-24 (20 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.ratehawk.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.emergingtravel.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://www.ratehawk.com/legal/site/privacy-policy/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-05-08", "words": 2973, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Version 1.0 | Updated: May 8, 2026", "says": "Last updated 2026-05-08" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The following table details the categories of data we collect and our legal basis for processing them:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "The actual retention period depends on the personal data processed and the country where the processing takes place." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Recipients may include travel service providers (such as hotels, airlines, and car rental companies) to fulfill and manage bookings;" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We may engage in interest-based advertising, which involves collecting information across websites, applications, and devices to infer user interests and deliver more relevant advertisements." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Regardless of this internal allocation, you may exercise your rights in respect of and against each of these entities." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions, concerns, or requests regarding your personal data, please contact our Data Protection Officer at [email protected], or by the address of the relevant entity indicated in Chapter 2 of the Notice.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Please note that your data may be transferred to and processed in countries outside your country of residence." } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We also share data with business, distribution, advertising, and fraud prevention partners, as well as companies within our corporate group for operational and administrative purposes." } ], "notes": [ { "date": "2026-10-08", "text": "AI is used in customer support, and the notice says personal data is not stored by the AI system or used to train AI models.", "quote": "This means your Personal Data is not stored by the AI system and is not used to train AI models in any case." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ratehawk.json", "live": { "slug": "ratehawk", "probe": { "target": "https://api.ratehawk.com", "method": "get", "lastAt": "2026-10-08T22:39:56.656026393Z", "lastOk": true, "lastStatus": 200, "lastMs": 112, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 132, "p95ms24h": 188, "samples24h": 36, "samples30d": 36, "days": [ { "date": "2026-10-08", "probes": 36, "ok": 36 } ] }, "vendorStatus": { "page": "https://status.emergingtravel.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T19:39:06.568833713Z" }, "updatedAt": "2026-10-08T22:39:56.656026393Z" } }, "verify": { "accepts": "a page on ratehawk.com or one of its subdomains, or the README of github.com/EmergingTravel/papi-sdk-python", "badgeUrl": "https://www.anchorterminal.com/badges/ratehawk.svg", "body": { "slug": "ratehawk", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/ratehawk", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/ratehawk\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/ratehawk.svg\" alt=\"ETG API (RateHawk) on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![ETG API (RateHawk) on Anchor Terminal](https://www.anchorterminal.com/badges/ratehawk.svg)](https://www.anchorterminal.com/tools/ratehawk)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/ratehawk\"\u003eETG API (RateHawk) on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/ratehawk", "json": "https://www.anchorterminal.com/tools/ratehawk.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/ratehawk.md", "slim": "https://www.anchorterminal.com/tools/ratehawk.min.md" }, "markdown": "## Overview\n\n**Grade D · 53/100 · rank #554 of 722 · #4 in Travel \u0026 booking · not agent-ready · confidence medium**\n\n\n## Assessment\n\nHotel search and booking are documented in a public Swagger 2.0 file, an llms.txt index and a changelog with 64 dated entries in 2026. Access is by contract. Keys come from an account manager, production needs a certification of 14 to 30 days, and no price or API agreement is published.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Emerging Travel Group (https://www.ratehawk.com) |\n| Kind | HTTP API |\n| Category | Travel \u0026 booking (https://www.anchorterminal.com/categories/travel) |\n| Transport | HTTP |\n| Endpoint | `https://api.ratehawk.com` |\n| Auth | API key · Access is by partner approval. A person registers at ratehawk.com/registration, picks API integration as the purpose, then asks an account manager for credentials, and the docs say the relevant agreement must be signed before the API is used. Keys are `\u003cKEY_ID\u003e:\u003cAPI_KEY\u003e` pairs sent as HTTP Basic auth, issued separately for sandbox, test and production. A production key follows a written certification that the docs put at 14 to 30 days. Each key has its own endpoint permissions and request limits, readable at `/api/b2b/v3/overview/`. |\n| Pricing | Your plan (Your plan) · No public price list. Partners buy at net rates under contract and pay from a deposit with a credit limit, at the hotel or by card, depending on the rate. The landing page calls the API key free, and the sandbox makes no real bookings or charges, but a key comes from an account manager after registration, so an agent cannot start without a person and an agreement (checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the docs, the Swagger file or the API landing page (checked 2026-10-08). |\n| Licence | Proprietary service under a signed partner agreement that is not published. The Python and PHP SDKs on GitHub are MIT |\n| Packages | pypi: `papi-sdk` |\n| Source | https://github.com/EmergingTravel/papi-sdk-python |\n| Docs | https://docs.emergingtravel.com/ |\n| llms.txt | https://docs.emergingtravel.com/llms.txt |\n| Last release | 2026-10-05 |\n| GitHub stars | 9 (as of 2026-10-08) |\n| PyPI downloads / week | 12 |\n| APIs | B2B API (search, prebook, booking, post-booking, documents, order groups, profiles, static dumps), Affiliate API, Content API (access on request, per the docs) and Midoffice webhooks, all version 3 |\n| Hosts | `https://api.ratehawk.com` for test and production, `https://api-sandbox.ratehawk.com` for sandbox. The worldota.net hosts are deprecated |\n| Auth | HTTP Basic with `\u003cKEY_ID\u003e:\u003cAPI_KEY\u003e`. Sandbox, test and production keys, several production keys possible across contracts, visible only to the master account |\n| Going live | Register, request keys from an account manager, build against the sandbox, pass written certification (14 to 30 days), then complete the partnership paperwork for a production key |\n| Booking flow | Search by region, geo or hotel IDs, retrieve the hotel page, prebook, create the booking process, start it, then poll the check call or receive a signed webhook |\n| Payment types | `deposit` (drawn from the partner's ETG deposit under a credit limit), `hotel` (paid at the property) and `now` (card, with a token from api.payota.net and 3-D Secure) |\n| Rate limits | Per endpoint and per key, set by contract. The docs' examples show 10 requests a second and 1,000 a minute. A 429 answers `endpoint_exceeded_limit` with the reset time |\n| Sandbox | Over 2,000 test hotels plus named hotels for price rises, taxes and errors. Language fixed to `en`, at most five rates a hotel in search, no card or 3-D Secure flows |\n| Spec and docs | Swagger 2.0 for B2B and Content, a Postman collection, `llms.txt`, and each page as Markdown at `index.md` |\n| SDKs | `papi-sdk` for Python (1.1.1, 19 January 2021) and `emerging-travel/papi-sdk-php` (v0.0.4, June 2021), both MIT and both defaulting to `api.worldota.net` |\n| Status | status.emergingtravel.com on Better Stack, nine monitors with 90 days of daily history, no written incidents for August to October 2026 |\n| MCP server | None found |\n| Capabilities | travel.stays, travel.booking, travel.changes, travel.search |\n| Tags | hosted, closed-source, openapi, llms-txt, sandbox, sales-led, certification, status-page, python, php, eu |\n| JSON | https://www.anchorterminal.com/api/v1/tools/ratehawk.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 45 | 9.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 85 | 13.8 |\n| Agent ergonomics | 13% | 16.2 | 69 | 11.2 |\n| Security \u0026 auth | 14% | 17.5 | 41 | 7.2 |\n| Payments \u0026 pricing | 10% | 12.5 | 10 | 1.2 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 65 | 5.7 |\n| Transparency \u0026 trust (editorial 32, provenance 80) | 7% | 8.8 | 56 | 4.9 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **53 → D** |\n\n### Why each score\n\n- Reliability 45: Graded as a hosted API. status.emergingtravel.com is a Better Stack page with nine monitors and 90 days of daily history, but its API monitors are named for the deprecated worldota.net hosts and it carries no written incident reports (15 of 20). The orders monitor recorded downtime of 6.9 hours on 21 July 2026, 2.4 hours on 24 July, 3.0 hours on 28 July and 1.3 hours on 14 September, and five other monitors show the 21 July outage, so we read several major outages (0 of 30). Request limits are per endpoint and per key, shown in four response headers and the overview call, with numbers only as examples (8 of 15). A 429 answers `endpoint_exceeded_limit` with the reset time, the docs say to retry 5xx with a cap on repeats, and `partner_order_id` makes booking retries safe, with no backoff guidance (12 of 15). No SLA found (0). Version 3 is generally available (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 85: A public Swagger 2.0 file covers the B2B and Content APIs with 48 operations and 171 definitions. It lists only a 200 response per operation and leaves out the Affiliate API (20 of 25). `llms.txt` and a Markdown copy of each page at `index.md` (10). Pages state each call's purpose, which calls are required and where a call should not be used, such as choosing rates from search results (16 of 20). Fields are typed and marked required, with five enums in the spec and GET calls that take JSON in a `data` query parameter (10 of 15). Each call page has sandbox and production examples and a list of error slugs, and the sandbox reproduces named errors (14 of 15). Version in the path and a changelog with 64 dated entries in 2026 (15).\n- Agent ergonomics 69: Search takes `hotels_limit`, a `timeout` and filters, and static content comes as dumps, but there is no field selection and booking responses are long (15 of 25). Bookings are paged with `page_size` and `page_number`, search is filtered by stars, kind, meal and price, with no paging in search (14 of 20). Errors are short slugs with a `debug` object naming the endpoint, limits and validation error, each documented with what to do next (18 of 20). `partner_order_id` identifies a booking, `lock` and `double_booking_finish` reject duplicates, and the docs give retry rules for booking and cancellation (16 of 20). A booking takes at least five calls, and the Python and PHP SDKs date from 2021 and point at the deprecated host (6 of 15).\n- Security \u0026 auth 41: HTTP Basic keys, separate for sandbox, test and production and per contract, never in the URL. No scopes, and no rotation or revocation procedure was found in the docs (20 of 30). Endpoint permissions are set per key by the account manager, a host or IP allowlist exists (`not_allowed_host`), and the sandbox makes no real bookings, with no confirmation step for cancellation (10 of 20). Hotel descriptions and guest reviews are third-party text and the docs give no injection guidance (3 of 15). Every response carries a `request_id` and bookings can be listed, with no operator log view documented (4 of 15). Card tokenisation is described as PCI DSS and booking webhooks carry an HMAC signature. No `security.txt`, disclosure policy, bug bounty or certification page was found (4 of 20).\n- Payments \u0026 pricing 10: No x402, MPP or L402 (0). No public price list, with net rates and limits set by contract (0). The landing page says the API key is free and the sandbox makes no charges, but a key comes from an account manager after registration and an agreement, so we give half (10 of 20). A person registers, requests keys and passes certification (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 65: The changelog's latest entry is 5 October 2026 (30). It has 15 dated entries between 10 July and 5 October 2026 (20). A public changelog, a named API support team and an address for support, with no public forum or issue tracker for the API (10 of 15). The official SDKs exist but are stale. `papi-sdk` 1.1.1 dates from 19 January 2021 and the PHP SDK from June 2021, and both default to `api.worldota.net` (3 of 15). The SDK repositories have CI workflows and no commits since 2021 (2 of 10).\n- Transparency \u0026 trust 56: Closed service whose partner agreement is not published, so the terms an integrator accepts cannot be read in advance. The SDKs are MIT (5 of 30). The RateHawk privacy notice, version 1.0 of 8 May 2026, names nine group entities as controllers and says data is kept until the purpose is achieved, with no periods and no DPA found (12 of 30). Deprecations appear as dated changelog entries with no stated policy, and the old sandbox host was given six days' notice on 24 June 2026 (10 of 20). Recipients are described by type, with no sub-processor list or data locations (5 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (16 items): https://www.anchorterminal.com/fixes/ratehawk.md (JSON https://www.anchorterminal.com/fixes/ratehawk.json)\n\n### What we couldn't check\n\n- The partner agreement's terms, including any SLA, data processing terms and limits on automated or AI use, are not public\n- Whether the worldota.net production host still answers and on what date it stops, since the docs call it deprecated without a date\n- Whether the status page's worldota.net monitors reflect the ratehawk.com API hosts\n- Real request limits for a new sandbox or production key, since the docs show only examples\n- How a partner rotates or revokes a key\n- unchecked: the old docs site at docs-old.emergingtravel.com and the Postman collection were not read\n- unchecked: security certifications of Emerging Travel Group beyond the PCI DSS statement on the card token page\n\n### Sources\n\n- docs home and llms.txt: \u003chttps://docs.emergingtravel.com/llms.txt\u003e (seen 2026-10-08)\n- authorisation (hosts, key types, Basic auth): \u003chttps://docs.emergingtravel.com/docs/fundamentals/authorization/\u003e (seen 2026-10-08)\n- request limits: \u003chttps://docs.emergingtravel.com/docs/fundamentals/request-limits/\u003e (seen 2026-10-08)\n- errors: \u003chttps://docs.emergingtravel.com/docs/fundamentals/errors/\u003e (seen 2026-10-08)\n- sandbox: \u003chttps://docs.emergingtravel.com/docs/fundamentals/sandbox/\u003e (seen 2026-10-08)\n- integration guide (registration, keys, Swagger link): \u003chttps://docs.emergingtravel.com/docs/integration-guide/\u003e (seen 2026-10-08)\n- certification and production access: \u003chttps://docs.emergingtravel.com/docs/certification/\u003e (seen 2026-10-08)\n- changelog 2026, read as Markdown: \u003chttps://docs.emergingtravel.com/docs/changelog/2026/index.md\u003e (seen 2026-10-08)\n- Swagger 2.0 file: \u003chttps://api.ratehawk.com/openapi.json\u003e (seen 2026-10-08)\n- start booking process (payment types, errors, retries): \u003chttps://docs.emergingtravel.com/docs/b2b-api/booking/start-booking-process/\u003e (seen 2026-10-08)\n- booking status webhook (retries, signature): \u003chttps://docs.emergingtravel.com/docs/b2b-api/booking/receive-booking-status-webhook/\u003e (seen 2026-10-08)\n- credit card token call: \u003chttps://docs.emergingtravel.com/docs/b2b-api/booking/create-credit-card-token/\u003e (seen 2026-10-08)\n- status page data, 90 days per monitor: \u003chttps://status.emergingtravel.com/index.json\u003e (seen 2026-10-08)\n- status page incident list: \u003chttps://status.emergingtravel.com/incidents\u003e (seen 2026-10-08)\n- API landing page: \u003chttps://www.ratehawk.com/lp/en-us/API\u003e (seen 2026-10-08)\n- privacy notice: \u003chttps://www.ratehawk.com/legal/site/privacy-policy/\u003e (seen 2026-10-08)\n- legal notice: \u003chttps://www.ratehawk.com/legal/site/legal-notice/\u003e (seen 2026-10-08)\n- Python SDK repository: \u003chttps://github.com/EmergingTravel/papi-sdk-python\u003e (seen 2026-10-08)\n- PHP SDK repository: \u003chttps://github.com/EmergingTravel/papi-sdk-php\u003e (seen 2026-10-08)\n- PyPI record for papi-sdk: \u003chttps://pypi.org/pypi/papi-sdk/json\u003e (seen 2026-10-08)\n- unauthenticated call, 401 with `no_auth_header`: \u003chttps://api.ratehawk.com/api/b2b/v3/overview/\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 80/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Leaside Services Limited | 20/20 |\n| Domain age | ratehawk.com, registered 2006-08-24 (20 years) | 15/15 |\n| Endpoint on the vendor's domain | api.ratehawk.com | 15/15 |\n| Terms of service | not found | 0/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.emergingtravel.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nNo terms document for the API is published. The docs say the relevant agreement must be signed before use, and the only public terms we found are website terms of use on emergingtravel.com, so the terms field is left out.\n\nThe RateHawk legal notice names Leaside Services Limited, a Cyprus company with registration number HE 342401, at Ifigeneias 17, Strovolos, Nicosia. The privacy notice (version 1.0, updated 8 May 2026) gives the same company an address in Limassol and lists eight other Emerging Travel entities as controllers by contract.\n\nThe API answers at api.ratehawk.com and api-sandbox.ratehawk.com. Card tokenisation is at api.payota.net and the docs are at docs.emergingtravel.com, both outside ratehawk.com.\n\n`/.well-known/security.txt` returned 404 on www.ratehawk.com, api.ratehawk.com, www.emergingtravel.com and docs.emergingtravel.com.\n\nRDAP gives ratehawk.com a registration date of 2006-08-24 and emergingtravel.com 2007-02-25.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. We found no terms of service published for this product, so there is nothing to read and the check scores 0.\n\n\n**Privacy policy** (https://www.ratehawk.com/legal/site/privacy-policy/), read 2026-10-08, dated 2026-05-08, states 8 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"We also share data with business, distribution, advertising, and fraud prevention partners, as well as companies within our corporate group for operational and administrative purposes.\"\n- Gives the date it was last updated. Last updated 2026-05-08.\n- Gives a privacy contact. Names a data protection officer.\n- Also in the text (2026-10-08). AI is used in customer support, and the notice says personal data is not stored by the AI system or used to train AI models. \"This means your Personal Data is not stored by the AI system and is not used to train AI models in any case.\"\n\n## Live (updated 2026-10-08 22:39 UTC)\n\n- Right now: up, HTTP 200, 112 ms, checked 2026-10-08 22:39 UTC (get on `https://api.ratehawk.com`)\n- Uptime 24h 100.0% (36 probes) · 30 days 100.0% (36 probes) · p50 132 ms · p95 188 ms\n- Vendor status page: unknown, no machine-readable status found\n- Always current: https://www.anchorterminal.com/api/v1/live/ratehawk.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Public Swagger 2.0 file at `https://api.ratehawk.com/openapi.json` with 48 operations and 171 definitions for the B2B and Content APIs\n- `llms.txt` and a Markdown copy of every docs page at `index.md`, with robots.txt allowing AI crawlers by name\n- Changelog with 64 dated entries in 2026, the latest on 5 October 2026\n- Sandbox host with over 2,000 test hotels, named error scenarios and no real bookings or charges\n- `partner_order_id` identifies a booking across retries, and the docs say how to handle `timeout`, `unknown` and 5xx during booking\n\n## Weaknesses\n\n- No self-serve key. Registration is followed by a request to an account manager, and the docs say an agreement must be signed before use\n- No public price list or API agreement was found. Rates and request limits are set per contract\n- The status page's orders monitor recorded downtime of an hour or more on four days between 21 July and 14 September 2026, with no written incident reports\n- Both official SDKs (Python and PHP) last changed in 2021 and default to `api.worldota.net`, a host the docs call deprecated\n- No `security.txt`, disclosure policy or security certification page was found on ratehawk.com, emergingtravel.com or the docs site\n\n## Before you call it (notes for agents)\n\n1. Call `/api/b2b/v3/overview/` first. It lists the endpoints the key may use and each one's request limit.\n2. Keep sandbox IDs, keys and hashes inside `api-sandbox.ratehawk.com`. Sandbox region IDs are limited to 2011, 2395, 2734 and 6053839.\n3. Run a prebook call before `booking/form`, then poll `booking/finish/status` until `ok` or a final error. Treat `timeout`, `unknown` and 5xx as still in progress.\n4. Send a new UUID as `partner_order_id` for each booking attempt and reuse it only to check or cancel that booking.\n5. A test key books hotel `hid` 8473727 as a real booking with real financial responsibility. Cancel it afterwards.\n\n## Connect\n\nFirst request:\n\n```bash\ncurl --user '\u003cKEY_ID\u003e:\u003cAPI_KEY\u003e' 'https://api-sandbox.ratehawk.com/api/b2b/v3/overview/'\n```\n\nThrough letme (picks today, calling later): https://letme.dev/ratehawk. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Duffel Flights and Stays API | B | 66.7 | 230 | travel.stays, travel.booking, travel.changes, travel.search | no | https://www.anchorterminal.com/tools/duffel.md |\n| LetsFG | B | 64 | 287 | travel.stays, travel.booking, travel.changes, travel.search | no | https://www.anchorterminal.com/tools/letsfg.md |\n| LiteAPI (Nuitee Connect) | D | 53.1 | 548 | travel.stays, travel.booking, travel.changes, travel.search | no | https://www.anchorterminal.com/tools/liteapi.md |\n| Travelport TripServices APIs | E | 45.9 | 653 | travel.stays, travel.booking, travel.changes, travel.search | no | https://www.anchorterminal.com/tools/travelport.md |\n| Expedia Group Rapid API | E | 42.8 | 674 | travel.stays, travel.booking, travel.changes, travel.search | no | https://www.anchorterminal.com/tools/expedia-rapid.md |\n| Booking.com Demand API | E | 38.1 | 697 | travel.stays, travel.booking, travel.changes, travel.search | no | https://www.anchorterminal.com/tools/booking-demand-api.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The Swagger 2.0 file covers the B2B API and the Content API (48 operations, 171 definitions, Basic auth). The integration guide labels it B2B only, so the Affiliate API has no machine-readable contract (source: \u003chttps://docs.emergingtravel.com/docs/integration-guide/\u003e)\n- Three key types exist. Sandbox keys work on sample hotels with no real bookings, test keys book one test hotel (`hid` 8473727) with real financial responsibility, and production keys follow certification (source: \u003chttps://docs.emergingtravel.com/docs/fundamentals/authorization/\u003e)\n- Certification is in writing, takes about 14 to 30 days per product, and includes mandatory test cases, a pre-certification checklist and logs or site access for ETG's QA team (source: \u003chttps://docs.emergingtravel.com/docs/certification/\u003e)\n- The hosts moved from `api.worldota.net` and `api-sandbox.worldota.net` to ratehawk.com hosts. The changelog entry of 24 June 2026 said the old sandbox host would stop on 30 June 2026, six days later (source: \u003chttps://docs.emergingtravel.com/docs/changelog/2026/\u003e)\n- Request limits are per endpoint and per key, reported in `X-RateLimit-SecondsNumber`, `X-RateLimit-RequestsNumber`, `X-RateLimit-Remaining` and `X-RateLimit-Reset` response headers. Raising them needs approval after certification (source: \u003chttps://docs.emergingtravel.com/docs/fundamentals/request-limits/\u003e)\n- The status page runs on Better Stack with nine monitors. Its API monitors are named for the worldota.net hosts, and its incident list for August to October 2026 is empty while the monitors show downtime (source: \u003chttps://status.emergingtravel.com/\u003e)\n- Card data for pay-now rates goes to a separate tokenisation endpoint at `https://api.payota.net/api/public/v1/manage/init_partners`, which the docs describe as PCI DSS processing (source: \u003chttps://docs.emergingtravel.com/docs/b2b-api/booking/create-credit-card-token/\u003e)\n- The landing page claims 3.3M+ accommodations, 330+ suppliers and 220 countries and territories (source: \u003chttps://www.ratehawk.com/lp/en-us/API\u003e)\n\n## Compare\n\n- [Booking.com Demand API vs ETG API (RateHawk)](https://www.anchorterminal.com/compare/booking-demand-api-vs-ratehawk.md): E 38.1 vs D 53\n- [Duffel Flights and Stays API vs ETG API (RateHawk)](https://www.anchorterminal.com/compare/duffel-vs-ratehawk.md): B 66.7 vs D 53\n- [Expedia Group Rapid API vs ETG API (RateHawk)](https://www.anchorterminal.com/compare/expedia-rapid-vs-ratehawk.md): E 42.8 vs D 53\n- [Hotelbeds Hotel Booking API vs ETG API (RateHawk)](https://www.anchorterminal.com/compare/hotelbeds-vs-ratehawk.md): F 36.3 vs D 53\n- [LetsFG vs ETG API (RateHawk)](https://www.anchorterminal.com/compare/letsfg-vs-ratehawk.md): B 64 vs D 53\n- [LiteAPI (Nuitee Connect) vs ETG API (RateHawk)](https://www.anchorterminal.com/compare/liteapi-vs-ratehawk.md): D 53.1 vs D 53\n- [ETG API (RateHawk) vs Skyscanner Travel APIs](https://www.anchorterminal.com/compare/ratehawk-vs-skyscanner.md): D 53 vs E 45.6\n- [ETG API (RateHawk) vs Travelport TripServices APIs](https://www.anchorterminal.com/compare/ratehawk-vs-travelport.md): D 53 vs E 45.9\n- [FlightClaw vs ETG API (RateHawk)](https://www.anchorterminal.com/compare/flightclaw-vs-ratehawk.md): E 45.3 vs D 53\n- [Kiwi.com MCP Server vs ETG API (RateHawk)](https://www.anchorterminal.com/compare/kiwi-mcp-vs-ratehawk.md): D 51.9 vs D 53\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on ratehawk.com or one of its subdomains, or the README of github.com/EmergingTravel/papi-sdk-python. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"ratehawk\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/ratehawk\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/ratehawk.svg\" alt=\"ETG API (RateHawk) on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![ETG API (RateHawk) on Anchor Terminal](https://www.anchorterminal.com/badges/ratehawk.svg)](https://www.anchorterminal.com/tools/ratehawk)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/ratehawk\"\u003eETG API (RateHawk) on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say ETG API (RateHawk) is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/ratehawk-dark.png\n- Light: https://www.anchorterminal.com/assets/share/ratehawk-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Travel \u0026 booking", "url": "https://www.anchorterminal.com/categories/travel" }, { "name": "ETG API (RateHawk)", "url": "" } ], "description": "Hotel search and booking API from Emerging Travel Group, the company behind RateHawk and ZenHotels. Contracted partners search rates, prebook, book and cancel stays over REST, with B2B, Affiliate and Content APIs.", "facts": [ "rank #554 of 722", "API key auth", "0 desk reviews" ], "h1": "ETG API (RateHawk)", "image": "https://www.anchorterminal.com/assets/og/tools-ratehawk.png", "path": "/tools/ratehawk", "published": "2026-10-01", "section": "tools", "title": "ETG API (RateHawk) review for AI agents, grade D (53/100)", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/ratehawk" }, "tokens": { "markdown": 6700, "slim": 1680 }, "version": 1 }