Get all booking membership restrictions

GET /api/configuration/bookings/restrictions/memberships

Success: 200 OK

Products: Operator (FOH)
Features: Front of House Generic Access (FOHGENERIC)

Overview

Lists the booking membership restrictions configured for the tenant. A restriction is a named rule that ties a set of activities to a set of membership types, so that those activities can only be booked by members holding one of those memberships. Operators use them to keep, say, a members-only class off the general booking list.

This list is a summary only. Each entry gives you the restriction's id, its name and when it last changed — it does not tell you which activities or which membership types the rule covers. To see the rule's contents, fetch the individual restriction by its id. Plan for two round trips if you need the full picture, or cache the detail alongside the summary.

Results are ordered by id ascending, which is creation order because ids are assigned in sequence. There is no filter parameter, no paging, and no active/inactive flag: every restriction the operator has ever created and not deleted appears, including ones that currently cover no activities and therefore have no effect.

When no restrictions exist you get 200 with an empty array [] — not a 404.

This endpoint is not open to end users. An anonymous or member-scoped token is rejected with 403; it is intended for back-office and integration credentials.

Endpoint

GET {base_url}/api/configuration/bookings/restrictions/memberships

{base_url} is the environment URL issued to your integration. See Authenticating with Gladstone APIs.

Sample request

cURL

curl -X GET '{base_url}/api/configuration/bookings/restrictions/memberships' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true'

Response fields

Field	Type	Description
`[].id`	integer (int32)	The restriction's identifier, assigned by Gladstone and unique within your tenant. Pass it to the single-restriction endpoint to retrieve the activities and membership types the rule actually covers, and to the update and delete endpoints. Allocated in sequence per tenant, so it is specific to one tenant — the same number means an unrelated rule in another tenant, and ids are not reused or reordered. Never hard-code one.
`[].description`	string	The operator's name for the rule, such as the label shown in the back office. Required and never `null`, with a maximum of 255 characters. It is free text with no uniqueness constraint, so two restrictions can share a description — match on `id`, never on this. It describes the rule, not its effect: the description will not tell you which activities or membership types are involved.
`[].modifiedOn`	string (date-time)	UTC timestamp of the last change to the restriction record, set automatically rather than by the caller. `null` on a restriction that has never been updated since it was created — a newly created rule has no value here, so do not use it as a proxy for "created on". Useful for incremental sync: compare it against your last poll to spot rules whose name changed. Be aware it reflects changes to the restriction itself, so adding or removing an activity from the rule does not necessarily move this timestamp — do not rely on it to detect changes to a rule's contents.

Sample response

200 OK

[
  {
    "id": 12345,
    "description": "string",
    "modifiedOn": "2026-08-14T19:00:00Z"
  }
]

Errors

Status	Meaning	When
`403`	Forbidden	The token does not carry a scope permitted on this route. Anonymous tokens and member tokens are both rejected with `403`. Use back-office or integration credentials, not a token minted for an end user.
`500`	Internal server error	Any unexpected server-side failure while reading the restrictions. The response is a bare status code with no body, so there is no detail to branch on. Retry with backoff.

This page as markdown · All pages · llms.txt