Inquiries and reviews
How a guest's question and a guest's review reach the host team, how the team works them in the dashboard, and the limits that keep the forms clean.
For the Full Stack package
How they reach the host
| On the website | In the dashboard |
|---|---|
| The contact form | An inquiry, with the guest's name, email, optional phone and message |
| The question dialog on a stay page | An inquiry about that stay, with the dates and the number of guests asked about |
| A review from a completed booking | A review, published on the stay page at once |
- Each one notifies, live, every admin who can view inquiries or reviews, and lands on the dashboard's Inquiries or Reviews page.
- The guest sees a confirmation on the page they are on. A question's message runs from 10 to 4000 characters and a review's comment from 10 to 2000, and the website checks both before sending, with the same limits the API applies.
- Nothing is sent by email, to the guest or to the host: the template has no mail service. The team replies from its own mailbox, and a developer can add a sender beside the notification.
Inquiries
| Status | Meaning |
|---|---|
| New | Just received. Every inquiry starts here. |
| Replied | The team has answered. |
| Closed | Finished, whatever the outcome. |
- The Inquiries page filters by status with the counts, and searches by reference (
I001and on), name, email or stay, twenty a page, beside the selected inquiry: its stay, the dates and guests asked about, the guest's details and what they wrote. - The detail panel changes the status and keeps an internal note, which the guest never sees.
- Inquiries cannot be deleted: close the ones you are done with.
Reviews
- A guest reviews a stay from their own booking page once the booking is completed, once per booking, with a rating from 1 to 5 in half stars and a comment of 10 to 2000 characters.
- A review is published on the stay page as soon as it is written, and the stay's average follows it.
- The Reviews page lists them eight to a page, with the counts of published and hidden reviews, a search by guest or comment, and filters for status, stay, the lowest rating and how recent they are (7, 30, 90 or 365 days). Publish and Hide change the stay's public average at once.
- Reviews cannot be deleted: hide the ones that should not be shown.
Keeping the forms clean
- Each address may send five questions and five reviews in ten minutes; the next one is refused with a message to wait. The counts live in the API's memory.
- A hidden field catches bots: a question that fills it is answered as usual and stored nowhere.
- Each question carries a one-time token, so a double click or a resend stores one inquiry, not two.
- Behind a reverse proxy, set
TRUST_PROXY=1in the API's.env, or every visitor shares the proxy's allowance.
Who can do what
| Permission | Allows |
|---|---|
inquiries.view | Reading inquiries, and being notified of new ones |
inquiries.edit | Changing an inquiry's status and note |
reviews.view | Reading reviews, and being notified of new ones |
reviews.moderate | Publishing and hiding reviews |
Both seeded roles, Super Admin and Manager, hold all four.
The routes behind them
POST /api/inquiries is public: name, email, message (10 to 4000 characters) and client_token, and optionally phone, stay_slug, check_in, check_out and guests. A review is POST /api/bookings/:reference/review with the booking's token or email, rating and comment, and a stay's published reviews are GET /api/stays/:slug/reviews. The dashboard reads and updates inquiries with GET and PATCH /api/inquiries/:id (status, admin_notes), and reviews with GET /api/reviews/manage and PATCH /api/reviews/manage/:id (status: published or hidden).