API reference
Public API for MyEscapeRoom: venue discovery, booking, leaderboards, file uploads, and the white-label B2B embed endpoints.
Base URL#
Every path in this reference is relative to the base URL (production). Bodies are JSON.
https://myescaperoom.euAuthentication#
Session cookie
SessionCookie
Better Auth session cookie for operator/player routes.
Venue API key
EmbedApiKey
A venue API key (mer_…), minted by the venue's admin or owner on the dashboard's API page. Send as Authorization: Bearer <key> or x-api-key. A request that carries an `Origin` header (a browser's) is refused with 403 ORIGIN_NOT_ALLOWED unless that origin is one of the venue's allowed origins, so a site that is not listed cannot call the API at all, whatever the key. A call with no `Origin` header (from your server) is not affected. Guests' names, emails and phone numbers come back null unless the key was granted "May read guest details" on the dashboard's API page.
Public discovery routes need no authentication, and a few public routes use the session when there is one. Staff routes require a Better Auth session cookie, scoped to a venue role (owner, admin or host, in decreasing order of access). The role a route needs is enforced by the API; some route descriptions state it, and Team & roles lists what each role can do. Embed routes require a venue API key in Authorization: Bearer or x-api-key, scoped to a single venue and its allowed origins. There is no rate limiting on any route today.
Conventions#
Errors. A failure is JSON { "code": "SOME_CODE" }, and { "code": "INVALID_INPUT", "issues": [{ "path", "message", "code" }] } when a body or query was refused (the issues are Zod's, one per bad field, all at once). Branch on code, never on the message. The status groups them: 400 the request itself was refused (INVALID_JSON, INVALID_INPUT, PHONE_REQUIRED, PHONE_INVALID, and the who-is-playing codes); 401 UNAUTHORIZED; 403 the caller may not (CANCELLATION_NOT_ALLOWED, API_KEY_NOT_PERMITTED, ORIGIN_NOT_ALLOWED); 404 nothing there (SLOT_NOT_FOUND, ROOM_NOT_FOUND, BOOKING_NOT_FOUND, VOUCHER_NOT_FOUND, INVOICE_REQUEST_NOT_FOUND); 409 the state of the slot, booking or voucher forbids it (SLOT_UNAVAILABLE, SLOT_IN_PAST, VENUE_UNAVAILABLE, DISCOUNT_EXHAUSTED, VOUCHER_EMPTY, VOUCHER_PAID, VOUCHER_IN_USE, PAYMENT_PROCESSING, INVOICE_ALREADY_REQUESTED, INVOICE_ALREADY_ISSUED, and the cancel codes); 422 well-formed, but the booking cannot be made as asked (INVALID_TEAM_SIZE, PAYMENT_MODE_NOT_ALLOWED, CONTACT_PRICING, DISCOUNT_INVALID, VOUCHER_INVALID, INVOICE_NOT_AVAILABLE, INVOICE_DEADLINE_PASSED); 502 STRIPE_ERROR and 503 STRIPE_NOT_CONFIGURED.