OpenAPI reference
Version 1.15.0 of the Keyspace third-party API, generated from its OpenAPI specification: 17 pages, one per operation and webhook, each with its parameters, request and response schemas, code samples and a request playground. The machine-readable spec is openapi.json; the same contract as prose is the full API reference.
Overview
Third-party REST API for the Keyspace Smart Building System: meeting-room and desk search with availability filtering, booking lifecycle (create / list / detail / update / cancel / check-in / check-out), and payment hand-off for paid rooms. Authenticate with OAuth 2.0 client credentials (app_id / app_secret) via POST /auth/accessToken, then send the access token as a Bearer token. Every response except the token endpoint is wrapped in the standard envelope {code, success, message, data, meta?} where code "KS000" means success. The full prose documentation is served at /llms-full.txt. Server-to-server webhooks: register a listener with your Keyspace contact and lifecycle events are POSTed to it, HMAC-SHA256 signed — see the WebhookEnvelope schema and the x-webhooks extension. Partner apps that own their users, card numbers and face photos can also provision members and credentials (/partner/members/*) — see the Partner members tag.
Servers
The playground sends requests to the first server unless you pick another one. Credentials are per environment.
| Environment | Base URL |
|---|---|
| UAT (default) | https://api.keyspace-qat.com |
| Development | https://api.keyspace-dev.com |
| Production | https://api.keyspace.tech |
Authentication
POST /auth/accessToken— Obtain or refresh an access token
Meeting Rooms
GET /meeting-rooms— List meeting rooms, optionally filtered to a free time windowGET /meeting-rooms/{id}— Get one meeting room (includes booking calendar)
Desks
GET /desks— List desks, optionally filtered to a free time windowGET /desks/{id}— Get one desk (includes booking calendar)
Meetings
GET /meetings— List bookings in a time windowPOST /meetings— Create a room or desk bookingGET /meetings/{id}— Get one bookingPATCH /meetings/{id}— Update or extend a bookingPOST /meetings/{id}/cancel— Cancel a bookingPOST /meetings/{id}/check-in— Check in to a bookingPOST /meetings/{id}/check-out— Check out of a booking (ends it — irreversible)
Partner members
GET /partner/members/{externalUserId}— Read one of your members — profile, status and credential summaryDELETE /partner/members/{externalUserId}— Offboard one of your membersPUT /partner/members/{externalUserId}— Create or update one of YOUR users as a Keyspace memberPUT /partner/members/{externalUserId}/credentials— Declaratively set the member’s cards and face
Webhooks
POST bookingLifecycle— Booking or visitor lifecycle event delivered to your registered listener URL
Full API reference
Version 1.15.0
Obtain or refresh an access token POST
OAuth 2.0 token endpoint. Use grant_type app_credentials with app_id/app_secret for the initial token, or grant_type refresh_token to rotate. Advanced: grant_type act_as (RFC-8693 token-exchange; the URN urn:ietf:params:oauth:grant-type:token-exchange is accepted as an alias) mints a short-lived, member-scoped token on behalf of one of your OWN federated members — send app_id/app_secret plus subject (default subject_type external_user_id). The delegated token is authorized at member ∩ app scope and carries NO refresh token (re-run act_as instead). Returns the token object directly (NOT wrapped in the standard envelope) and no token_type field — always send the token as `Authorization: Bearer <access_token>`. Token lifetimes are environment configuration: derive expiry from expires_in, never hardcode.