Hotel Engine Authentication

generated: '2026-08-04'
method: searched
source: https://engine-public.github.io/engine-partner-api/integration-guide.html
docs: https://engine-public.github.io/engine-partner-api/integration-guide.html
summary:
  types: [mutualTLS]
  api_key_in: []
  oauth2_flows: []
  note: >-
    The Omni Partner API authenticates exclusively with Mutual TLS (mTLS) client certificates —
    on both the gRPC and the HTTP/JSON surface. There are no API keys, no bearer tokens, and no
    OAuth. Because mTLS is a transport-layer mechanism, it is not expressible in Swagger 2.0
    securityDefinitions, so the published spec carries no securityDefinitions block at all; the
    auth contract lives only in the prose docs. This was verified live: a TLS 1.3 handshake to
    partner-api.engine.com:443 emits a "Request CERT" (certificate request) message and the
    connection yields no HTTP response without a client certificate.
schemes:
  - name: mTLS
    type: mutualTLS
    transport: [grpc, http-json]
    endpoint: partner-api.engine.com:443
    description: >-
      Mutual TLS client-certificate authentication. Engine provisions a private key and
      certificate per partner during onboarding; contact the Omni team to have one issued.
    provisioning: manual, via the Omni partnership process
    credential_request: omni-partnerships@engine.com
    sources:
      - https://engine-public.github.io/engine-partner-api/integration-guide.html
      - live TLS probe of partner-api.engine.com:443 (2026-08-04)
    example_grpc: |
      grpcurl -protoset descriptor_set.desc \
        -key /path/to/private.key \
        -cert /path/to/cert.pem \
        partner-api.engine.com:443 \
        engine.content.api.v1.ContentService.ListProperties
spec_gap:
  finding: >-
    openapi/_original/hotel-engine-omni-partner-api-2.4.0-swagger-original.json declares no
    securityDefinitions and no security requirement on any of its 11 operations, so an agent or
    codegen tool reading the spec alone cannot discover that a client certificate is required.
  recommendation: >-
    Emit a Swagger `securityDefinitions` stub or migrate the generated document to OpenAPI 3.1,
    where `type: mutualTLS` is a first-class security scheme. Engine already maintains its own
    protoc-gen-openapi plugin that produces OpenAPI 3.1, so the path exists in-house.
onboarding:
  self_serve: false
  process: >-
    Partnership agreement required. Complete the intake form at https://omni.engine.com/#contact
    and contact omni-partnerships@engine.com; a sandbox environment is provisioned on approval.
related:
  conventions: conventions/hotel-engine-conventions.yml
  domain_security: security/hotel-engine-domain-security.yml
  scopes: null   # no OAuth surface — scopes/ intentionally not emitted