getBookingDetails returns -32600 Access Denied, but getBookings works fine with same token

API General
1

Hi team,

I’m building an integration using the Company Administration API (JSON-RPC, user-api.simplybook.asia/admin/). I’m running into a consistent issue with one specific method.

What works:

  • getUserToken — returns a valid token successfully
  • getBookings — returns full booking data successfully, using that same token

What fails:

  • getBookingDetails — returns {"error":{"code":-32600,"message":"Access denied","data":[]}} on every single call, using the exact same token, company login, and headers as the working getBookings call above

I’ve confirmed:

  • The token is fresh and valid (confirmed by the successful getBookings call in the same session)
  • The endpoint URL includes /admin/
  • The booking id parameter is a valid, real booking ID from the getBookings response

Since one admin-scoped method works and another doesn’t, with identical auth, I suspect this might be gated behind a specific Custom Feature, plan tier, or client-data permission on my account that isn’t obvious from the general docs.

Could someone confirm whether getBookingDetails requires anything beyond standard API access — and if so, how to enable it?

Company login: venusvilladanceacademy

Thanks!

3

Please provide full response of getBookings and request of getBookingDetails that is failing.
Meanwhile, this can happen if the user you are logging in with has no access to the booking (e.g. if connected to some provider), or no access to an individual booking in general (e.g. has “viewer” role)

4

Thanks for checking! The user I authenticate with (raphaeljordi33@gmail.com) is set to Admin role — not Viewer or a restricted role — so that doesn’t appear to be the issue.

Here’s the full data you asked for:

getBookings response (sample booking object):

{
  "id": "15248",
  "record_date": "2026-08-23 22:24:09",
  "start_date": "2026-08-31 19:00:00",
  "end_date": "2026-08-31 20:30:00",
  "client_timezone": null,
  "unit_id": "28",
  "text": "Admin",
  "client": "Admin",
  "unit": "Venus / Hernan",
  "unit_email": "info@venusvilladanceacademy.com",
  "event": "[Mon 19:00-20:30] All Levels - Variations (AT26)",
  "event_id": "50",
  "is_confirm": "0",
  "client_id": "31",
  "client_phone": "+85269039895",
  "client_email": "info@venusvilladanceacademy.com"
}

getBookingDetails request (using the same booking id from above):

{"jsonrpc": "2.0", "method": "getBookingDetails", "params": [15248], "id": 1}

Response:

{"error": {"code": -32600, "message": "Access denied", "data": []}, "id": "1", "jsonrpc": "2.0"}

Both calls use the same token, headers, and company login (venusvilladanceacademy), obtained via getUserToken. Only getBookingDetails fails. Let me know what else might be useful to check on my end.

5

I’ve checked on a copy of your database, and both getBookings and getBookingDetails worked for me, for the given id.
I still suspect the limited access, or lack of token in the last request.
Could you give us the last 4 characters of the token you were using?

6

Thanks for your reply. I generated a fresh token and tested immediately. Here are the last 4 characters: 8526

getBookingDetails still returns the same -32600 Access denied error with this brand new token. getBookings continues to work fine using the same fresh token, same session, same headers.

7

Hi, after investigating: It appeared that your token has expired and you just need to issue a new one.

It was tested from our side and everything works correctly.

8

I just tested again with a completely fresh token — same result. Here’s the exact sequence:

  1. Generated a new token via getUserToken
  2. Immediately called getBookings — works fine
  3. Immediately called getBookingDetails with a valid booking id from that same response — still returns:
{"error": {"code": -32600, "message": "Access denied", "data": []}, "id": "1", "jsonrpc": "2.0"}

This wasn’t a stale/expired token — it was generated seconds before the failing call. Since your team’s test worked on your side, could it be something specific to my account setup rather than the token itself? Happy to share anything else that would help pin it down — API key, specific booking IDs to test, timestamps, etc.

9

Just confirmed the token in my last test wasn’t cached or pinned anywhere on my end (checked in n8n) — it was a genuinely fresh token, generated seconds before the failing call, with the exact same result: -32600 Access denied.

I also found a similar issue reported on this forum from 2022 (ticket #921) with the identical error format — in that case it turned out to be server-side token caching, which they couldn’t have detected from the client side either.

One question: you mentioned testing on a copy of my database — could that copy have different permission or Custom Feature settings than my live account? If there’s any chance the copy doesn’t reflect the current live state, that might explain why it works there but not for me. Would it be possible to test directly against my live account instead?

10

To summarize what I’ve ruled out so far:

  • Token expiry/caching — tested with a completely fresh token, generated seconds before the failing call
  • Stale/pinned data on my end — confirmed no pinning in my automation tool
  • User role/permissions — the authenticating user (raphaeljordi33@gmail.com) is set to full Admin, not Viewer or a restricted role
  • Wrong method name — getBooking doesn’t exist; getBookingDetails is the correct/only method for this data

getBookingDetails remains the only documented method that returns additional_fields (needed for our Intake Forms data), and it’s the only one consistently returning -32600 Access denied, while getBookings, getClientList, and getClientInfo all work fine with the same token and headers.

Since your last test was on a copy of my database, would it be possible to test directly against my live account? Happy to provide any specific booking IDs, timestamps, or additional detail that would help.

11

Hi, we tested on production and it works correctly.

12

Just ran a precise, timestamped test on my live account:

  • 12:11pm HKT — generated a fresh token via getUserToken, ending in ...9cdeb6b3
  • 12:12pm HKT — immediately called getBookingDetails with that token, requesting booking id 16120

Request:

json

{"jsonrpc": "2.0", "method": "getBookingDetails", "params": [16120], "id": 1}

Headers: X-Company-Login: venusvilladanceacademy, X-User-Token: [the fresh token from 12:11pm]
Endpoint: https://user-api.simplybook.asia/admin/

Response:

json

{"error": {"code": -32600, "message": "Access denied", "data": []}, "id": "1", "jsonrpc": "2.0"}

Could someone test this exact same booking id (16120) against my live company (venusvilladanceacademy) right now, so we’re comparing results from the same moment in time on the same data? If it succeeds on your end with this exact request, that would confirm something differs between our environments rather than the request itself — and I’d really appreciate help figuring out what that is.

For reference, I’ve already ruled out on my end: token expiry/caching, pinned/stale data, incorrect header names, incorrect method name, incorrect regional domain (tested .asia, .me, .it, .pro — all fail identically), and user role (confirmed Admin, not Viewer).

13

Please take a look on prod server

14

Hi, we tested many times, including your company:

It works correctly, please double check your code. It looks like you are using invalid token.

15

Found it — the issue was on my side. Sorry for that. The token field in my automation tool was set to send the expression as literal text instead of evaluating it, so an invalid token was being sent. Fixed now and getBookingDetails works perfectly. Thanks for your patience and for testing on production!