Version: 1.4

All Out Partner API

The Partner API lets companies sell All Out activities to their own customers, under their own brand. You show the catalogue, ask All Out whether a slot can be booked, hold the customer's card, report the hold, and then capture or release it once the activity provider approves or declines the booking.

All Out never receives, holds, captures or refunds your customer's money. You report each payment step to All Out through this API.

Derived from the All Out for Business Partners: Partner API Guide v1.4. The guide is authoritative; change it first, then mirror the change here.

Conventions

• Time is UTC epoch milliseconds. All activities are in the UAE (Asia/Dubai, UTC+4). Take start times only from the slots route and send them back unchanged.
• Money is a decimal string with exactly two digits and a currency: "315.00", AED. 315, 315.0 and the number 315.00 are refused.
• Answers share one envelope: isSuccess, message, data. A refusal adds error.code and a requestId to quote to All Out. Branch on the HTTP status and error.code, never on the message text.
• Safe retries. Payment updates and cancellations require an Idempotency-Key header (1 to 200 characters): a new value for each new update, the same value when you retry. Availability requests are identified by your partnerRequestReference.
• Limits. 10 token requests a minute and 120 requests a minute on all other routes. Beyond a limit you get 429 RATE_LIMITED with Retry-After. A JSON body can be up to 100 KB; a guest document up to 5 MB. HTTPS only.
• Fields you send that a route does not list are ignored.

Never enter real credentials in this documentation. Browser sending is disabled because the client secret must stay on your server.

Authentication

HTTP: Bearer Auth

Access token from POST /auth/token, valid for one hour. Any 401 means get a new token, then retry.

Security Scheme Type:	http
HTTP Authorization Scheme:	bearer
Bearer format:	JWT

Contact

All Out partner support:

License

Proprietary