You can be making your first authenticated OHIP API call in minutes: import Oracle Hospitality's Postman collection, set HostName and client credentials, request an OAuth token and run a safe GET such as /v1/properties or /v1/accounts. OHIP here means the Oracle Hospitality Integration Platform Postman collections. This guide walks through prerequisites, exact Postman steps, common troubleshooting, Canadian cost and tax notes, and alternatives if Postman isn't your tool.

Quick-reference summary

- Where to get the collections: GitHub repository and Postman workspace (links below).

- Core environment variables: HostName, CLIENT_ID, CLIENT_SECRET, AppKey (and username/password for some flows).

- Auth flows: OAuth 2.0 Resource Owner (password) and Client Credentials.

- First test: import property collection, set env vars, obtain token, try GET Accounts (ARS) or GET Properties endpoints.

- Costs: Oracle licensing and support fees apply; Postman plans vary (see Postman pricing). Software sold to Canadian buyers is typically charged GST (5%) or HST depending on province. Ontario HST 13%.

- Useful URLs: GitHub repo, https://github.com/oracle/hospitality-api-docs. Postman workspace, https://www.postman.com/hospitalityapis/workspace/oracle-hospitality-apis/overview. Postman pricing, https://www.postman.com/pricing. Canada tax overview, https://www.canada.ca/en/revenue-agency/services/tax/businesses/topics/gst-hst.html.

Prerequisites

Basically, before you start, make sure you have:

- A Postman desktop or web account (Postman Free is fine for basic testing; paid tiers give team collaboration and mock servers).

- Access to the Oracle Hospitality developer program or partner portal. Your property or vendor admin must request API access and issue credentials (CLIENT_ID, CLIENT_SECRET, AppKey). Production access is usually provisioned after contractual onboarding with Oracle Hospitality.

- A development or UAT hostname (API gateway URL). Oracle provides separate endpoints for UAT and Production, create a distinct Postman environment for each.

- If you're in Canada: corporate purchasing or vendor contract to cover Oracle licensing. Expect licence/support fees billed in CAD and subject to GST/HST (federal GST 5%, Ontario HST 13% as of 2026). Confirm tax treatment with your finance team and the vendor contract.

Step-by-step: import and run the OHIP Postman collection

  1. Download or open the collection. In your browser go to the GitHub repository at https://github.com/oracle/hospitality-api-docs or open the Postman workspace at https://www.postman.com/hospitalityapis/workspace/oracle-hospitality-apis/overview. You can either clone the repo or click the Postman collection link to import directly into Postman.
  2. Create a Postman environment. In Postman click Environments > Create new. Add variables:
    • HostName, the API gateway base URL your Oracle contact gives you (UAT or Production).
    • CLIENT_ID, client credential or integration username.
    • CLIENT_SECRET, corresponding secret.
    • AppKey, an application key header Oracle requires.
    • Username and Password, if you will use Resource Owner flow for user-scoped tokens.
    Save the environment and select it from the top-right environment dropdown.
  3. Import the collection JSON. If you cloned the repo, import the JSON file named oracle-hospitality-property.postman_collection.json for property APIs or oracle-hospitality-distribution.postman_collection.json for distribution APIs. Use the Postman import button and link it to your environment. Confirm collection variables reference the environment variables you created.
  4. Configure authentication in Postman. Collections usually include preconfigured auth requests. For Client Credentials flow set grant_type=client_credentials. For Resource Owner flow set grant_type=password and provide username/password. If the collection uses pre-request scripts, ensure they reference the Client ID/Secret and HostName variables correctly. AppKey is often sent in a header (for example X-App-Key or AppKey), add it to collection-level headers so every request sends it.
  5. Request an OAuth token. Run the token request included in the collection. If successful you'll get an access_token and expires_in value. Postman typically stores the token in an environment variable so subsequent calls use Authorization: Bearer {{access_token}}.
  6. Test a simple GET. Start with a safe, read-only endpoint: try GET /v1/accounts (Accounts from ARS) or GET /v1/properties. Expect HTTP 200 and a JSON payload. If you get 401, check the token; 403 usually means not enough permission or missing AppKey; 404 may mean wrong HostName or path version.
  7. Move to functional workflows. Collections include sample flows such as creating reservations, check-in/check-out, distribution actions. Run them in UAT first and inspect request/response bodies. Use Postman’s History and Console to view headers, raw requests and error details.

Detailed checks and troubleshooting

- Token expired? Use the expires_in value and refresh or re-run the token request. Client Credentials tokens typically last minutes to hours depending on config.

- AppKey missing or invalid: add the AppKey at the collection level as a header named AppKey (some environments use X-App-Key). Check the onboarding documentation from Oracle or contact your Oracle admin.

Mastheads

- HostName mismatch: UAT and Production hostnames differ, using the Production hostname against UAT credentials (or vice versa) will return auth errors.

- Scope and permissions: API client credentials are bound to specific scopes and roles. If a request fails with 403, confirm your client has the required scope for that module (Reservations, ARS, Distribution).

- Oracle OHIP access is provided under Oracle Hospitality contracts. Pricing depends on product modules, number of properties, and support tiers. There's no public flat rate for all customers, expect a licensing fee plus annual support and optional integration services.

- Postman: The Postman Free plan is enough for single dev testing. For teams and CI/CD integration, Postman Team or Business plans are recommended. Check current plans and per-seat pricing at https://www.postman.com/pricing.

- Taxes: Software and cloud services sold to Canadian businesses are subject to GST (5%) and, where applicable, provincial HST. For example, Ontario HST is 13% as of 2026.

See the Canada Revenue Agency for details: https://www.canada.ca/en/revenue-agency/services/tax/businesses/topics/gst-hst.html. Confirm with Oracle and your procurement team whether prices shown are net of tax or include tax.

- Eligibility: API access is typically restricted to registered Oracle Hospitality customers or certified integration partners. If you’re an independent developer, ask your property client or systems integrator to request API credentials on your behalf.

- OpenAPI / Swagger: The repo includes REST API specifications in OpenAPI format. You can use those specs to generate client SDKs (using OpenAPI Generator) instead of Postman for automated or typed client code.

- SDKs and libraries: Some integrations work better with vendor-supplied SDKs or middleware platforms (Mulesoft, Boomi). Compare development speed: Postman is best for testing and manual exploration; SDKs are better for production code.

- Postman vs automated testing: Postman suits interactive testing and pre-request scripting. For CI/CD, consider Newman (Postman CLI) or converting specs to contract tests run in pipelines.

- Keep separate environments for UAT and Production. Never store Production CLIENT_SECRET in a shared public workspace.

- Use Postman variables for sensitive data and enable secret masking in team settings.

- Capture sample request/response payloads and store them in a reference collection for developers and QA.

- Use the OpenAPI specs to generate typed clients, that reduces manual header mistakes and makes error handling consistent.

- Using the wrong HostName for credentials, always confirm you’re pointed at the environment your credentials were issued for.

- Forgetting the AppKey, many requests silently fail without it or return 403.

- Hard-coding secrets into shared collections, use environment variables and encrypted secrets where possible.

- Skipping contract or compliance checks when moving to Production, some operations require higher privileges or specific configuration on the property server.

- Assuming token lifetime, check expires_in and plan for token refresh in long-running scripts.

Related Articles

Use this Postman workflow to validate flows in UAT, then migrate validated calls into CI/CD or production using the supplied OpenAPI specs or Oracle SDKs. Before go-live, confirm licensing, billing currency and GST/HST treatment with procurement and finance.

This article was created with AI assistance.