generated: '2026-09-18'
method: derived
source: >-
  Derived from openapi/edelweiss-hotel-polyana-api-openapi.json and live probes
  of the API endpoints.
summary: >-
  Anonymous, read-only public-data API. Five GET operations returning JSON or
  XML, no authentication, wide-open CORS, and CDN caching. There is no write
  surface, so replay-protection and reversal semantics do not apply.
auth_style: none
transport: HTTPS only (TLS 1.3, HSTS max-age 31536000)
content_types:
  - application/json
  - application/xml (Google Hotels feed)
  - text/plain (llms manifests)
cors:
  policy: open
  header: 'Access-Control-Allow-Origin: *'
  evidence: observed on /api/ai-info/
caching:
  cache_control: public, max-age=3600, s-maxage=86400, stale-while-revalidate=604800
  note: Static/near-static hotel data; heavy CDN caching is expected.
path_style:
  note: >-
    Endpoints canonicalize to a trailing slash — /api/quote and /api/search
    308-redirect to /api/quote/ and /api/search/. Clients should follow
    redirects or call the trailing-slash form.
pagination:
  style: parameter-capped
  params:
    - per_page (search result cap, default 20)
  note: >-
    Only /api/search exposes a result cap; no cursor or page tokens. The other
    endpoints return complete fixed documents.
localization:
  languages: [uk, en]
  param: lang (uk|en) on /api/search
error_envelope:
  note: >-
    The contract declares only 200 responses; no RFC 9457 problem+json envelope
    is documented. /api/search returns {results:[],total:0,query} on a no-match
    rather than an error.
idempotency:
  coverage: na
  note: >-
    Read-only API — every operation is a naturally idempotent GET with no
    side effects. There is no mutating surface for an Idempotency-Key to protect.
reversibility:
  grade: na
  note: >-
    Read-only API — no create/update/delete/booking-commit operation is exposed
    (booking is handled off-API via directBookingUrl), so there is nothing to
    reverse. na leaves the denominator rather than scoring zero.
dry_run:
  supported: na
  note: Read-only API; no action to rehearse.
rate_limit_signaling:
  note: >-
    No X-RateLimit-*/RateLimit-* headers observed and none documented. See
    rate-limits/edelweiss-hotel-polyana-api-rate-limits.yml.