Service level agreement

Draft — pending product sign-off. Response-time targets, maintenance windows, incident policy and support response times, stated in terms partners can measure themselves.

Quendoo Connect is free. There is no fee per property, no charge per API call and no paid tier — for the integrator or for the hotels it connects.

Availability — 99.9% monthly

Measured over each calendar month, per endpoint bucket (/oauth, /properties, /room_types, /rate_plans, /rates, /availability, /inventory, /bookings, /webhooks). A minute counts as unavailable when the health check for that bucket returned a 5xx or timed out for ≥60 s.

Uptime	Downtime budget / month
99.99%	4 m 22 s
99.9% (SLA target)	43 m 12 s
99.5%	3 h 39 m 30 s
99.0%	7 h 18 m 18 s

Response time

Measured at the QC edge, excluding your network path to it. Each target is the rolling 30-day percentile per endpoint bucket.

Bucket	p50	p95	p99
Reads (`GET /properties`, `/room_types`, `/rate_plans`, `/availability`, `/rates`)	90 ms	250 ms	800 ms
Configuration writes (`POST/PATCH /extra_services`, `/promotions`, `/policies`, …)	120 ms	400 ms	1 200 ms
Inventory writes (`POST /inventory/*`)	150 ms	500 ms	1 500 ms
Booking revisions feed (`GET /bookings?revisions`)	100 ms	300 ms	900 ms
Webhook delivery latency (event → outbound POST leaves us)	800 ms	3 s	10 s

Bookings live on the revisions feed with a 24h retention on acks-pending rows; if you disconnect for a week you can still catch up. Webhook delivery is at-least-once with a retry ladder of 5 s → 10 s → 30 s → 5 min → 1 h × 20; a subscription that returns non-2xx for more than 72 h consecutively is auto-disabled and surfaced in your dashboard.

Rate limits

Rate limits are per client, per endpoint bucket, per minute. Every response carries the standard triple:

X-RateLimit-Limit:     600
X-RateLimit-Remaining: 597
X-RateLimit-Reset:     1735689600

Default budgets

Bucket	Per minute	Per day
Reads (`GET`)	300	100 000
Booking create (`POST /bookings`)	60	20 000
Token (`POST /oauth/token`)	10	500

The headers on every response are authoritative for your client. A higher budget is a configuration change on our side, free of charge — ask us when your sync needs it.

Idempotency window — 24 h

Every write accepts an Idempotency-Key. We remember the response under that key for 24 hours from the original write. Replay with the same key + same body returns the cached response plus Idempotency-Replayed: true. Same key + different body returns 409 errors.qc.idempotency_conflict. After 24 h a fresh write with the same key is treated as a new operation.

Redis-backed, no durable table — a Redis outage will surface as 409-until-recovered, which is the safer failure mode.

Maintenance windows

Regular window: Sundays 04:00–05:00 UTC. May be unavailable for ≤ 10 minutes within that hour. Does not count against the 99.9%.
Announced maintenance: any longer window is announced ≥ 7 days in advance via email + status page
- Sunset HTTP header on affected endpoints. Announced windows do not count against the 99.9%.
Emergency maintenance: rare; announced on the status page as it happens.

Incident policy

Detection → status page acknowledgement: 15 minutes.
Status page updates: every 30 minutes while an incident is active, or on state change if sooner.
Post-mortem: published within 5 business days for any incident that crossed 99.9% or affected a P0 bucket (inventory / bookings).
Comms channels: status page (RSS, JSON, email subscriptions), the Sunset header, and a POST to any webhook subscription scoped to platform.incident_ack / platform.incident_resolve.

Support response

Severity	Business-hours acknowledgement	Update cadence
P0 — production down, no workaround	15 minutes, 24×7	Every 30 min
P1 — production degraded, workaround available	1 hour, 24×7	Every 2 h
P2 — non-blocking bug or question	4 business hours	Business day
P3 — feature request, docs feedback	2 business days	On-progress

Business hours are 09:00–18:00 Europe/Sofia, Mon–Fri, excluding Bulgarian public holidays.

Support portal, email, and the X-Support-Ticket header (auto- opens a ticket) all count as the same channel. Reply-to on any outbound ticket email works.

Data retention & export

Booking revisions: 13 months on the feed; older on request.
Rate limits history: 13 months, queryable per-client.
Webhook deliveries log: 90 days per subscription, includes redelivery button.
Full data export: JSON dump of every QC-owned surface for your properties, 24 h to produce, 7-day download link. No charge.

Sunset & versioning

/v1/qc/* is stable for 12 months minimum from GA.
A next major (/v2/qc/*) is announced ≥ 6 months before the previous one is retired, and the two run in parallel for the full overlap.
Additive changes ship without a version bump; a breaking change always bumps the major.

Excluded from SLA

Traffic that failed our authentication or authorization checks (auth failures do not count as availability misses).
Traffic that violated the rate-limit budget for your client (429s are correct behaviour).
Requests routed to us over an unsupported HTTP protocol (HTTP/1.0, plaintext, weak TLS < 1.2).
Downstream failure at your endpoint for outbound webhooks — latency is measured at the moment we hand off, not at your ingest.

What we monitor internally

Uptime and p95/p99 per endpoint bucket — public on the status page, hourly-resolution history.
Shadow-diff score per PMS v1 method — see PMS v1 facade. Non-public but quotable on request.
Every 4xx/5xx by error key — surfaced under your dashboard's "API errors" tab so you spot regressions in your own code before they cost bookings.

Signing this

The numbers on this page are the draft partner-facing SLA. Sign-off is with Quendoo's product team; once agreed, the wording lands verbatim in every enterprise MSA and this page is linked from the OpenAPI info.termsOfService.