Endpoint discovery and validation
All paths below are relative to https://a1.reserveamerica.com/jaxrs-json. This is an unofficial public frontend API, not an independently documented API contract. The upstream notebook and ReserveAmerica's shipped frontend JS supplied the request shapes. No credentials or raw live responses are committed.
| Endpoint | Metadata / behavior | Verification on 2026-11-07 |
|---|---|---|
/config/brand?brandName=RA | Bulk states/provinces and contracts (IDs, codes, names); search filters, booking-window configuration | Live JSON verified. US states drive ingestion; Canadian coverage is deferred. |
/search?stype=state&tstc=CO&interest=camping&rcp=0&rcs=50 | Bulk paginated campground metadata: contract/facility ID, description, coordinates, state, availability capability, external/day-use flags | All nine CO pages validated: 344 records, 44 eligible native overnight facilities. Counts are a point-in-time observation. |
/products/CO/50028?gad=2027-01-05&gal=14&rcp=0&rcs=50 | Bulk paginated sites and daily grids; site attributes, loop, site type and booking restrictions | Complete live scan returned 115 sites available on the selected night after removing the selected-stay snapshot gate. Server chooses page size; client must honor pagination. gal=1 produced HTTP 417 with an array-index error. |
/facilities/CO/50028?detailsOnly=false | Rich facility metadata: timezone, contact address, amenities and facility details | Live JSON verified with anonymous cookies. Available for future catalog enrichment; ingestion currently avoids one extra request per facility. |
/config/contractandfacility?contractCode=CO&facilityID=50028 | Contract/facility configuration referenced by frontend | Request shape verified in shipped JS; live probes returned 401. Not used. |
/facilities/CO/50028/lobdetails/camping | Camping-specific details referenced by frontend | Request shape verified in shipped JS; live probes returned 401. Not used. |
/destinations/destination-products | Nearby destination recommendations; frontend passes countryname, regionname, lat/lng, arrival/departure and optional result count | Bare request rejected as invalid. This is not evidence of an exhaustive directory/export. Not used. |
/config/resources/countries | Country/state lookup used by checkout | Discovered in JS only. Not used. |
No full campground dump/export was verified. Unscoped and contract-scoped search probes returned 401, so they are not treated as reliable replacements for the verified state search. The www and api hosts returned 403 in this environment. Authorization behavior varies by endpoint; failed requests must continue to raise, never look like empty availability.
Automated verification uses synthetic HTTP responses and SQLite: pagination, date windows and checkout clipping, exact statuses, day-use/phone-only filtering, DTO attributes, anonymous session refresh, HTTP/schema/pagination failures, dynamic brand state discovery, repeated atomic catalog refresh, provider isolation, stale records, rollback, migration seed lifecycle, and registry inclusion.
Verification results: task check passed repository-wide formatting, lint, all six import contracts, MyPy (139 files) and frontend TypeScript checks. The final backend suite passed (909 tests, 23 environment/opt-in skips); release tests passed (17), frontend tests passed (340), and Pages tests passed (10) with production builds, Function bundling and real static/proxy HTTP verification. Installed wheel/sdist suites passed 66 cases on the first run; three base-install registry assertions still expected 12 providers and were updated to check all 13 plus the ReserveAmerica class, then rerun separately. No production behavior changed to address those assertions.
The migration head was exercised on fresh and previously versioned temporary SQLite databases; no operator database was modified. Docker's daemon is unavailable, so PostgreSQL migration smoke remains unverified. Full-country database ingestion has not been run; persistence and rollback have synthetic SQLite integration coverage.
Additional live pre-PR checks parsed complete availability responses for NY_695 and FLFS_1120158 on 2027-01-05 (both yielded zero eligible available sites for that night), and both generated campground URLs resolved to HTTP 200 overview pages. Positive availability was verified in the earlier Colorado scan.
Nationwide catalog count
A subsequent read-only crawl on 2026-11-07 completed all 50 US states from the brand catalog without errors. After de-duplicating contract/facility identities, the directory contained 8,172 unique facilities, of which 1,004 meet this provider’s native, verifiable, visible, overnight-camping criteria. The provider creates 0 separate recreation areas: facility records map directly to campgrounds. Counts cover the US only, exclude Canadian provinces, and are not a count of individual campsites. No database ingestion was performed for this census.
Review verification
Independent review identified that reservableType is a selected-stay snapshot, not a daily-grid eligibility flag. For live CO_50028 site 1269 on 2027-01-05, the gad/gal response reported daily AVAILABLE with a null snapshot and ENTER_DATE CTA; adding selected-stay arv/lsy changed the snapshot to WEB_AVAILABLE and CTA to BOOK_NOW. Other grid-available sites had FIELD_AVAILABLE snapshots. Removing that snapshot gate increased the complete sample scan from 85 to 115 available sites. Regression tests cover null, unavailable, call-center and field snapshots with later available nights, while excluding daily walk-up and call-center statuses. The frontend never references callCenterReservable; that flag is retained as metadata rather than interpreted as a phone-only restriction. Only the exact per-night AVAILABLE status is reported.
The reviewer verified the follow-up and reported no remaining actionable findings. All 32 focused provider/migration tests passed; the reviewer independently ran all 28 provider tests. The full backend suite was rerun after the final fix with 909 passed and 23 opt-in skips. Scoped Ruff/MyPy and pre-commit checks passed.
Cookie lifecycle hardening
Synthetic HTTP regressions reproduced stale token headers after API Set-Cookie rotation and reuse of a known-invalid session after two 401 responses. Headers now derive from the actual request-scoped cookie jar for every API attempt, honoring domain/path/expiry and cookie deletion. For duplicate names, the first cookie in the HTTP client’s path-ordered request header wins, so an API-path rotation overrides an older root token. After an unsuccessful one-time refresh, the next operation bootstraps before calling the API. Tests additionally cover concurrent callers sharing one refresh. This does not claim live cookie-expiry acceptance: the expiry/rotation scenarios are synthetic. Generic 403 responses continue to fail; no proactive refresh timer or login-redirect handling was added without a verified expiry signal.
Cookie follow-up verification: final full backend run passed (915 tests, 23 opt-in skips), all 38 provider/migration regressions passed, and repository-wide task check passed. The reviewer reported no actionable findings and independently verified rotation, expiry, and duplicate-path cookie precedence.
The Providers page now lists ReserveAmerica in both popular/all sections in place of Yellowstone Lodges, with its booking URL, US coverage, camping features and rounded 1,000+ campground count. Frontend types, lint and all 340 tests passed. Desktop light/dark screenshots were inspected locally and on macOS CI run 42411836647; accepted baselines use the macOS captures to match CI rendering.
Public URL correction
The API-accessible a1 host also appeared in public links, where the user reported broken navigation. Public provider, campground and campsite links now target https://www.reserveamerica.com; API requests and cookie bootstrap retain explicit a1 URLs. The original seed migration remains unchanged; a forward data migration corrects previously seeded URLs and preserves custom overrides. Regression tests verify both rendered provider-card links, generated booking destinations, API/session host isolation, URL migration round trips, and fresh/existing database upgrades. This environment still receives HTTP 403 from www, so successful public navigation is not claimed as a live automated acceptance check here.
Public URL verification: 918 backend tests passed (23 opt-in skips), all 341 frontend tests passed, and repository-wide task check passed. The reviewer independently verified the public-host/API-host split, frontend link regression, and guarded migration behavior with no actionable findings. PostgreSQL verification of the new URL migration remains delegated to CI because Docker is unavailable locally.