The HTTP API behind liveinrented.com and the LiveInRented Android app: verified paying-guest and hostel listings in Delhi NCR, India.
https://liveinrented.com/api
Every response is JSON. Every error is JSON. There is no XML, no HTML error page and no envelope around successful responses.
Endpoints under /api/public/ need no authentication at all** — no API key, no token, no sign-up, no registration. If you are building an agent or an integration, these are the endpoints you want.
/api/public/
Every other endpoint takes a Firebase ID token for a signed-in LiveInRented user:
Authorization: Bearer <firebase-id-token>
There is no API key, service account or machine credential, and there is no plan to add one. Booking a room, saving a favourite, chatting with an owner and paying rent are things a person does with their own account — an integration should send the user to the page rather than try to act for them.
A missing or bad token returns 401 with error: "unauthenticated". A valid token without the right role returns 403 with error: "forbidden".
401
error: "unauthenticated"
403
error: "forbidden"
/api/public/pgs
listPublicPgs
/api/public/pgs/{id}
getPublicPgDetail
/api/public/hostels
listPublicHostels
/api/public/hostels/{id}
getPublicHostelDetail
/api/me
getMyProfile
/api/me/favourites
listMyFavourites
/api/me/favourites/{pgId}
saveFavourite
removeFavourite
/api/bookings/mine
listMyBookings
/api/bookings/waitlist
listMyWaitlist
/api/bookings/credits
getMyBookingCredits
/api/pgs/mine
listMyPgs
/api/hostels/mine
listMyHostels
"Role-aware" means the server decides from the verified token whether you are the renter or the owner in this context, runs the matching query, and tells you which one it ran in the response's role field. You cannot ask for the other one.
role
Endpoints under /api/internal/** are not public, are guarded by a shared secret, and are not part of this contract.
/api/internal/**
List the catalogue:
curl -s https://liveinrented.com/api/public/pgs
[ { "pgId": "PhCKs2oa07dkWI09TikP", "pgName": "Sunrise Residency", "location": "Sector 62, Noida", "price": "₹8500", "seaterType": "Double Seater", "gb": "Boys", "imageUrl": "https://storage.googleapis.com/…/cover.webp", "createdAt": 1755600000000 } ]
Fetch one listing in full:
curl -s https://liveinrented.com/api/public/pgs/PhCKs2oa07dkWI09TikP
The response has four top-level keys:
light
details
host
name
avatarUrl
reviews
A signed-in call:
curl -s https://liveinrented.com/api/me \ -H "Authorization: Bearer $FIREBASE_ID_TOKEN"
light and details are passed through from the store verbatim, because the schema is owned by the Android app and re-declaring it here would be a second source of truth that silently drops fields the app adds. Tolerate properties you do not recognise — they will appear. The properties documented in openapi.json are the stable ones.
The two verticals differ: a PG lets a room (Bed Available keyed Seater 1/2/3, one gender policy for the property), a hostel lets a bed in a dorm (Room Available keyed dorm_2/3/4, gender set per dorm). A hostel id does not resolve under /public/pgs/{id}.
Bed Available
Seater 1/2/3
Room Available
dorm_2/3/4
/public/pgs/{id}
Every failure returns JSON in one shape, with the right HTTP status:
{ "error": "listing_not_found", "message": "This listing is no longer available.", "hint": "Check the id, or list currently published listings with GET /api/public/pgs.", "docs": "https://liveinrented.com/docs#errors" }
error
message
hint
docs
fields
validation_failed
unauthenticated
forbidden
listing_not_found
not_found
method_not_allowed
rate_limited
Retry-After
internal_error
Every response carries the standard headers:
RateLimit-Limit: 20 RateLimit-Remaining: 18 RateLimit-Reset: 47 RateLimit-Policy: 20;w=60
RateLimit-Reset is seconds until the window resets. A 429 additionally carries Retry-After, also in seconds. Throttle on these headers rather than on a fixed sleep — the limit is per-client and the window is 60 seconds.
RateLimit-Reset
429
The two catalogue feeds return the entire catalogue, un-paginated, and are served from a 30-minute server-side cache. Re-fetching in a loop returns identical bytes and gains you nothing — cache them your side too.
Please send a descriptive User-Agent that identifies your client and offers a way to reach you.
User-Agent
Every content page has a Markdown twin at the same path with .md appended — /about → /about.md. HTML responses advertise it with a Link: </about.md>; rel="alternate"; type="text/markdown" header.
.md
/about
/about.md
Link: </about.md>; rel="alternate"; type="text/markdown"
This is version 1.0.0. error codes and the light / details / host / reviews envelope are a contract; new fields may be added to any response, so parse permissively. Breaking changes will get a new version and an announcement to anyone who has been in touch at support@liveinrented.com.