# Get all booking status restrictions

`GET /api/configuration/bookings/restrictions/status`

- **Success:** `200 OK`
- **Products:** Operator (`FOH`)
- **Features:** Front of House Generic Access (`FOHGENERIC`)

HTML version: [Get all booking status restrictions](https://support.gladstonesoftware.cloud/reference/configuration/get-all-booking-status-restrictions)

## Overview

Lists the booking status restrictions configured for the tenant. Each entry names a **member status** (the operator-defined state a member record sits in — active, suspended, in arrears, and so on) that is barred from making bookings. Call it to work out, before you attempt a booking, whether a member's status will block them.

The booking check is blunter than these fields suggest. When a member books, the only question asked is whether their status appears **anywhere** in this list; `restrictionId` is not considered, and the block is not narrowed to particular activities or membership types. So a status listed here is blocked from booking outright, no matter which restriction the entry was filed under. Treat the list as a flat set of barred statuses and ignore any grouping the `restrictionId` field appears to imply.

Each entry pairs a status with a restriction, so the same `statusId` can appear more than once under different `restrictionId` values — deduplicate on `statusId` before using the result.

Results come back in no guaranteed order, and there is no filter parameter and no paging: every entry is returned. When nothing is configured you get `200` with an empty array `[]`.

This endpoint is not open to end users. Anonymous and member-scoped tokens are rejected with `403`.

## Endpoint

`GET {base_url}/api/configuration/bookings/restrictions/status`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Sample request

```bash title="cURL"
curl -X GET '{base_url}/api/configuration/bookings/restrictions/status' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true'
```

## Response fields

| Field | Type | Description |
|-------|------|-------------|
| `[].id` | integer (int32) | The identifier of this status-to-restriction pairing, assigned by Gladstone and unique within your tenant. It identifies the pairing, **not the status and not the restriction** — pass it to the delete endpoint to remove this single pairing. It is meaningless outside this tenant and must never be hard-coded. |
| `[].statusId` | string | The member status barred from booking, and the field that actually matters. Maximum 15 characters, never `null`, and always an entry in the tenant's status list — so the value here will always resolve to a real status. **Operator-defined per tenant**: statuses are configured by the operator, not drawn from a platform-wide enumeration, so a code such as `SUSPENDED` may not exist in another tenant. Compare it against the `statusId` on the member record to decide whether that member can book. |
| `[].statusDescription` | string | The display name of the status, included from the status so you do not have to make a second call. Maximum 25 characters, and it can be `null` while `statusId` is populated — fall back to `statusId` when rendering. Free text the operator can edit; never match on it. |
| `[].restrictionId` | integer (int32) | The booking membership restriction this entry was filed under. **Read this field with care.** It can only hold values 0–255, whereas booking membership restriction ids can be larger — a restriction with an id above 255 simply cannot be referenced here. The value is also not validated when it is written, so it can point at a restriction that does not exist or has since been deleted. Nullable, and `null` on entries created without one. Most importantly, the booking-time check ignores this field entirely (see the Overview), so an entry with a dangling or absent `restrictionId` still blocks its status. Use it for grouping in an admin UI at most; do not build access logic on it. |

## Sample response

```json title="200 OK"
[
  {
    "id": 12345,
    "statusId": "string",
    "statusDescription": "string",
    "restrictionId": 12345
  }
]
```

## Errors

| Status | Meaning | When |
|--------|---------|------|
| `403` | Forbidden | The token does not carry a scope permitted on this route. Anonymous tokens and member tokens are both rejected with `403`. Use back-office or integration credentials. |
| `400` | Bad request | Not returned in practice: the endpoint takes no parameters and applies no validation, so there is nothing to reject. Do not write a handler that expects a meaningful message. |
| `404` | Not found | Not returned in practice. The endpoint has no path parameters; an empty configuration yields `200 []`, not `404`. Ignore it. |
| `500` | Internal server error | Any unexpected server-side failure while reading the restrictions or their statuses. The response is a bare status code with **no body**. Retry with backoff. |