# Hyatt Hotels

> Hyatt Hotels Corporation (NYSE: H) is a Chicago-headquartered global hospitality company
> that develops, owns, operates, manages, franchises and licenses hotels, resorts, branded
> residences and vacation-ownership properties across a portfolio of brands including Park
> Hyatt, Grand Hyatt, Hyatt Regency, Andaz, Alila, Thompson Hotels, Hyatt Centric, Hyatt
> Place, Hyatt House, Miraval, Destination by Hyatt and the Inclusive Collection. This file
> is generated by API Evangelist from the catalog profile; it is not published by Hyatt.

## Status

Hyatt publishes **no public API program**. As of 2026-09-13 there is no developer portal, no
API reference, no machine-readable contract (OpenAPI, AsyncAPI, GraphQL SDL, Postman
collection or JSON Schema) and no SDK in any public package registry.

What does exist:

- **An API gateway with no public door.** `api.hyatt.com` is a CNAME to `apigw.hyatt.com`, a
  live Google-fronted gateway. The apex refuses the TLS handshake to outside clients; the
  gateway itself answers a bare HTTP 404 with a zero-byte body on `/`, `/openapi.json`,
  `/swagger.json`, `/api-docs`, `/docs`, `/graphql`, `/mcp` and every `/.well-known/` path.
- **No developer hosts.** `developer.hyatt.com`, `developers.hyatt.com`, `apis.hyatt.com`,
  `partner.hyatt.com`, `partners.hyatt.com` and `devportal.hyatt.com` do not resolve in DNS.
- **An empty GitHub org.** `github.com/hyatt` is genuinely Hyatt Hotels Corporation's
  (created 2014-12-01) and has 0 public repositories.
- **Integration happens through vendors.** Hyatt's published technology partnerships route
  integration through third parties rather than a first-party API: Hapi for event streams
  and transactional APIs (including the digital-key integration), and Sabre's SynXis as the
  central reservation system from 2024. Those contracts belong to those vendors.
- **An agent surface Hyatt does not host.** Hyatt launched a Hyatt-branded app inside
  ChatGPT (announced February 2026) for conversational hotel search, alongside
  natural-language search on Hyatt.com. The app is hosted by OpenAI and reachable only
  inside ChatGPT; Hyatt publishes no MCP endpoint, no agent card and no tool schema of its
  own, so no MCPServer or AgentCard pointer is recorded for it.

**Crawler note.** The customer-facing hosts — `www.hyatt.com`, `about.hyatt.com`,
`world.hyatt.com` — sit behind an edge bot challenge that answers HTTP 403 (Hyatt error code
E6020) to every automated request, including `/robots.txt` and the homepage, and HTTP 429
when sent a full browser header set. Nothing on those hosts could be read by this profile.

## Security

- [Hyatt Bug Bounty Program on HackerOne](https://hackerone.com/hyatt): public since
  2019-01-09; scope Hyatt.com, m.hyatt.com, world.hyatt.com and the iOS/Android apps.
- [Hyatt Launches Public Bug Bounty Program With HackerOne](https://newsroom.hyatt.com/hackerone-bug-bounty):
  the first-party announcement.
- Security contact `security@hyatt.com`, published by Hyatt in the `hyatt.com` CAA `iodef`
  record.

## Company

- [Hyatt](https://www.hyatt.com/): Booking and brand site.
- [About Hyatt](https://about.hyatt.com/): Corporate site.
- [World of Hyatt](https://world.hyatt.com/): Loyalty program.
- [Hyatt Newsroom](https://newsroom.hyatt.com/): News releases and media resources.
- [Hyatt Investor Relations](https://investors.hyatt.com/overview/default.aspx): Financials and filings.
- [Hyatt Careers](https://careers.hyatt.com/): Open roles.
- [Hyattconnect](https://hyattconnect.com/): Owner and colleague portal (login required).
- [Hyatt Resource Portal](https://hyattdevelopment.com/): Hotel-development partner portal (login required).
- [Hyatt on LinkedIn](https://www.linkedin.com/company/hyatt)
- [Hyatt on GitHub](https://github.com/hyatt): Organization, 0 public repositories.

## API Evangelist

- [APIs.json profile](https://raw.githubusercontent.com/api-evangelist/hyatt-hotels/refs/heads/main/apis.yml)
- [Domain security probe](https://raw.githubusercontent.com/api-evangelist/hyatt-hotels/refs/heads/main/security/hyatt-hotels-domain-security.yml)
- [Vulnerability disclosure](https://raw.githubusercontent.com/api-evangelist/hyatt-hotels/refs/heads/main/security/hyatt-hotels-vulnerability-disclosure.yml)
- [Well-known probe](https://raw.githubusercontent.com/api-evangelist/hyatt-hotels/refs/heads/main/well-known/hyatt-hotels-well-known.yml)
- [Packages](https://raw.githubusercontent.com/api-evangelist/hyatt-hotels/refs/heads/main/packages/hyatt-hotels-packages.yml)
- [Plans and pricing](https://raw.githubusercontent.com/api-evangelist/hyatt-hotels/refs/heads/main/plans/hyatt-hotels-plans-pricing.yml)
- [Rate limits](https://raw.githubusercontent.com/api-evangelist/hyatt-hotels/refs/heads/main/rate-limits/hyatt-hotels-rate-limits.yml)