Subject
OwnerRez API: New Rate Limits Nov. 3 and Stricter Validation Jan. 5
Body
Hi [first name]!
You're receiving this because you own or are the technical contact for an OwnerRez API app or a personal access token used in the last 30 days.
On Tuesday, January 5, 2027 at 15:00 UTC, API v2 list endpoints will stop accepting offset greater than 0. A request to any list with offset greater than 0 will return 400 with error code offset_not_supported.
Bookings, deposits, fees, guests, inquiries, messages, payments, quotes, refunds, and reviews already return a cursor link in next_page_url, and every other list will by November 16, 2026. To page through any list, request the first page without offset (or with offset=0), then request the URL in next_page_url exactly as returned until it is null. That works today on every list. Don't build page URLs for later pages yourself.
GET /v2/bookings?property_ids=123&since_utc=2026-10-01T00:00:00Z&limit=100
{ "items": [ … ], "next_page_url": "/v2/bookings?property_ids=123&since_utc=2026-10-01T00:00:00Z&limit=100&cursor=eyJ…" }
GET /v2/bookings?property_ids=123&since_utc=2026-10-01T00:00:00Z&limit=100&cursor=eyJ…
A cursor walk also stops returning duplicate or missing rows when records are added or deleted between pages.
Two more kinds of requests that are mishandled silently today get a 400 on the same dates, on every API v2 endpoint:
- Unknown query parameters return
400with codeunknown_parameter. The parameters each endpoint reads are the ones listed in its API reference page; check your requests against it now. The message names each parameter the endpoint doesn't read and, for the most common misspellings, the documented one to use. Today they are ignored: on/v2/spotrates, property_idinstead ofproperty_idsreturns every property's overrides, and page=2 returns the first page. Request bodies aren't checked. - Mismatched cursors return 400 with code
invalid_cursor: a cursor the API didn't issue, or one sent with different filters from the request that issued it. Filters are every query parameter exceptcursor, limit andoffset. Today the cursor is dropped and the first page comes back. Requestnext_page_urlexactly as returned, and start again from the first page when you change a filter.
Before January 5, all three fail with the same 400s during three scheduled brownouts:
- Tuesday, November 17, 2026, 15:00–16:00 UTC
- Tuesday, December 1, 2026, 15:00–19:00 UTC
- Tuesday, December 8, 2026, 15:00 UTC to Wednesday, December 9, 2026, 15:00 UTC
If your integration doesn't send offset above 0, sends only documented query parameters, and requests next_page_url as returned, nothing changes for you.
Separately, starting Tuesday, November 3, 2026 at 15:00 UTC, each access token (an app's connection to an account or a personal access token) may make 1,000 API requests in any 5-minute window, regardless of the addresses they come from. This is in addition to the existing per-address limit. Requests over either limit return 429 with a Retry-After header indicating how many seconds to wait; wait that long before retrying. During the week of October 1 to 8, 11 of about 11,000 active tokens exceeded 1,000 within about 5 minutes.
Details: Pagination & ETags and the API Change Log.
Questions? Contact partnerhelp@ownerrez.com.
-The OwnerRez Team