---
title: "Issue a mobile key"
url: "https://portal2.konghotels.cloud/apis/kong-hotels-guest-stay-api-1/versions/b4bfa113-0e33-46cc-8723-38e7ac5e7863/operations/issueKey"
---

> Full API specification: https://portal2.konghotels.cloud/apis/kong-hotels-guest-stay-api-1/versions/b4bfa113-0e33-46cc-8723-38e7ac5e7863.md

# Issue a mobile key

`POST` `/stays/{confirmationNumber}/keys`

Operation ID: `issueKey`

**Write.** Issues a key to one device. Only available once the stay is `checked_in` and a room is assigned. Up to 4 active keys per stay.

## Path parameters

- `confirmationNumber` (string, required) - Confirmation number from the Partner API reservation.

## Header parameters

- `Idempotency-Key` (string, optional) - Optional. Makes the request safe to retry for 24 hours.

## Request body (required)

Content types: `application/json`

## Responses

- `201` - Key issued.
- `401` - Rejected by Kong Gateway: missing or invalid credentials.
- `404` - Not found, or not visible to your consumer.
- `409` - The stay is not in a state that allows this action. Check `actions` on the stay.
- `422` - Validation failed
- `429` - Too many requests.

## OpenAPI definition

```yaml
openapi: 3.1.0
info:
  title: Kong Hotels Guest Stay API
  version: 1.0.0
servers:
  - url: https://stay.konghotels.cloud
    description: Production (Kong Gateway)
paths:
  /stays/{confirmationNumber}/keys:
    post:
      tags:
        - Mobile Keys
      operationId: issueKey
      summary: Issue a mobile key
      description: "**Write.** Issues a key to one device. Only available once the
        stay is `checked_in` and a room is assigned. Up to 4 active keys per
        stay."
      parameters:
        - $ref: "#/components/parameters/ConfirmationNumber"
        - $ref: "#/components/parameters/IdempotencyKey"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MobileKeyRequest"
      responses:
        "201":
          description: Key issued.
          headers:
            X-Request-ID:
              $ref: "#/components/headers/RequestId"
          content:
            application/json:
              schema:
                type: object
                required:
                  - data
                properties:
                  data:
                    $ref: "#/components/schemas/MobileKeyWithCredential"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "404":
          $ref: "#/components/responses/NotFound"
        "409":
          $ref: "#/components/responses/Conflict"
        "422":
          $ref: "#/components/responses/ValidationFailed"
        "429":
          $ref: "#/components/responses/RateLimited"
security:
  - KongKeyAuth: []
components:
  parameters:
    ConfirmationNumber:
      name: confirmationNumber
      in: path
      required: true
      description: Confirmation number from the Partner API reservation.
      schema:
        type: string
        examples:
          - KH4DEMO01
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      description: Optional. Makes the request safe to retry for 24 hours.
      schema:
        type: string
        maxLength: 255
  schemas:
    MobileKeyRequest:
      type: object
      required:
        - device_id
        - platform
      properties:
        device_id:
          type: string
          maxLength: 128
          description: Stable identifier for the guest's device.
        platform:
          type: string
          enum:
            - ios
            - android
        guest_name:
          type:
            - string
            - "null"
          maxLength: 100
          description: Shown on the key, e.g. for a second guest in the room.
    MobileKeyWithCredential:
      allOf:
        - $ref: "#/components/schemas/MobileKey"
        - type: object
          required:
            - credential
          properties:
            credential:
              type: string
              description: Opaque payload for the lock vendor SDK. Returned once, at issue
                time.
    MobileKey:
      type: object
      properties:
        id:
          type: string
          examples:
            - key_7Hq2mX
        device_id:
          type: string
        platform:
          type: string
          enum:
            - ios
            - android
        guest_name:
          type:
            - string
            - "null"
        room_number:
          type: string
          examples:
            - "1412"
        status:
          type: string
          enum:
            - active
            - revoked
            - expired
        valid_from:
          type: string
          format: date-time
        valid_until:
          type: string
          format: date-time
    Problem:
      type: object
      description: RFC 9457 problem details. Same shape as the Partner API.
      required:
        - type
        - title
        - status
      properties:
        type:
          type: string
          format: uri
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        instance:
          type: string
        request_id:
          type: string
      additionalProperties: true
    ValidationProblem:
      allOf:
        - $ref: "#/components/schemas/Problem"
        - type: object
          properties:
            errors:
              type: object
              additionalProperties:
                type: array
                items:
                  type: string
  headers:
    RequestId:
      description: Unique request identifier for support.
      schema:
        type: string
    RetryAfter:
      description: Seconds to wait before retrying.
      schema:
        type: integer
  responses:
    Unauthorized:
      description: "Rejected by Kong Gateway: missing or invalid credentials."
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/Problem"
          example:
            type: https://api.konghotels.cloud/problems/unauthorized
            title: Unauthorized
            status: 401
            detail: Missing or invalid API key.
            request_id: 9a8b7c6d-5e4f-4a3b-2c1d-0e9f8a7b6c5d
    NotFound:
      description: Not found, or not visible to your consumer.
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/Problem"
          example:
            type: https://api.konghotels.cloud/problems/not-found
            title: Resource not found
            status: 404
            detail: Stay not found.
            request_id: 9a8b7c6d-5e4f-4a3b-2c1d-0e9f8a7b6c5d
    Conflict:
      description: The stay is not in a state that allows this action. Check `actions`
        on the stay.
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/Problem"
          example:
            type: https://api.konghotels.cloud/problems/invalid-stay-state
            title: Action not available
            status: 409
            detail: The stay is not checked in yet.
            request_id: 9a8b7c6d-5e4f-4a3b-2c1d-0e9f8a7b6c5d
    ValidationFailed:
      description: Validation failed
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/ValidationProblem"
          example:
            type: https://api.konghotels.cloud/problems/validation-failed
            title: Validation failed
            status: 422
            detail: estimated_arrival_time must match HH:MM.
            request_id: 9a8b7c6d-5e4f-4a3b-2c1d-0e9f8a7b6c5d
    RateLimited:
      description: Too many requests.
      headers:
        Retry-After:
          $ref: "#/components/headers/RetryAfter"
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/Problem"
  securitySchemes:
    KongKeyAuth:
      type: apiKey
      in: header
      name: apikey
      description: Your API key, validated by Kong Gateway.
```