Endpoint: https://api.myallocator.com/callback/ota/{ota}/v202203 (replace {ota} with your channel ID)

Use this callback to send us new bookings. Using this callback ensures that
there is no delay between the creation of the booking and import on
Cloudbeds. Therefore it's strongly recommend to implement this callback.
Even when implemented it's still necessary to also implement the
GetBookingList and GetBookingId calls, which act as fallbacks if
the CreateBooking notification fails, when a reimport due to processing
issues on Cloudbeds is necessary, or when a specific booking needs to be
debugged.

The booking format is identical to what is being returned in the
GetBookingId call. The booking format is described
here in full detail.

See the documentation about GetBookingId for more details on the format.
The specification listed here is not complete and just the minimal
requirement.

The request body is a JSON object (Content-Type: application/json)
carrying mya_property_id (or ota_property_id), shared_secret and
booking_json, with booking_json embedded directly as a JSON object.
Existing integrations submitting application/x-www-form-urlencoded
form fields continue to work.

Sending credit/debit card data

Guest credit/debit card data (the booking's Payments object) is not
accepted at the standard BookingCreate endpoint shown above. Bookings
that contain card data must be sent to a dedicated, PCI-compliant endpoint
that Cloudbeds provides specifically for your channel.

To send card data, your channel must be enabled for card handling:

• Provide a PCI Attestation of Compliance (AoC) document to Cloudbeds.
  Card data cannot be enabled for a channel until the AoC has been received
  and approved.
• Cloudbeds configures your channel for card handling and provides you
  with the dedicated secure URL to use in place of the standard
  BookingCreate endpoint, along with the credentials described below.
• Authenticate every request to the secure URL either with the
  tx-proxy-key header (a secret key that Cloudbeds issues to your channel),
  or from a set of source IP addresses that you supply to Cloudbeds for
  allow-listing.

The request format is identical to the standard endpoint: post the same JSON
booking, including the Payments object with the card details. Bookings that
do not contain card data are sent to the standard endpoint.

Within the Payments object, CardNumber and SeriesCode must be encoded
as JSON strings (quoted values, e.g. "SeriesCode": "143"), never as bare
JSON numbers. The secure endpoint tokenizes these values in place with
non-numeric tokens; unquoted numeric values cannot be tokenized.

Requests to the secure endpoint must use application/json.
multipart/form-data is not supported on the secure endpoint.

A booking that contains card data is rejected with an error and not
imported unless your channel has been enabled for card handling. In that
case the response has Success: false and ErrorCode 1032.