The Reputation Management Kit brings the ability to manage your reptuation on Tripadvisor to your platform. Available as an add-on for enterprise customers (Growth, Scale, and Innovate packages), partners can sign-up and integrate quickly with an API key and OAuth credentials.

This guide explains what the kit does, who it is for, how it works, and how to build a good integration. For the API details, see the reference pages.

Why owner responses matter

Replying to reviews is among the cheapest things a business can do to win bookings. Tripadvisor's own data is clear:

Who it is for

Reputation and guest-experience platforms. For reputation management platforms, your customers already see their Tripadvisor reviews in your product. With the Reputation Management Kit they can answer them within your platform instead of switching to Tripadvisor's Management Center.

Hotel groups and multi-property operators. Central teams can answer reviews across dozens or thousands of listings without a separate login per property, and see in one queue what is pending and what is live.

What's in the Reputation Management Kit

The kit adds write actions to the Terra API you already use. Reviews themselves still come from Location Reviews.

How it works

sequenceDiagram
    participant O as Listing owner
    participant P as Your platform
    participant TA as Tripadvisor
    O->>P: Connect Tripadvisor account
    P->>TA: OAuth authorization (PKCE)
    TA-->>P: Owner's access token
    P->>TA: GET /locations/{id}/reviews (API key)
    TA-->>P: Reviews
    O->>P: Writes a reply
    P->>TA: POST …/owner-responses (API key + owner token)
    TA-->>P: 201, PENDING_MODERATION
    TA->>TA: Moderation
    P->>TA: GET …/owner-responses/{ownerResponseId}
    TA-->>P: PUBLISHED or REJECTED

1. Connect. The owner signs in with Tripadvisor and grants your app permission. You receive an access token on their behalf. See OAuth for the Reputation Management Kit.
2. Read. Fetch reviews with the Terra endpoints you already use, for Locations on your allowlist.
3. Respond. Your user writes the reply in your product. You post it with your API key and the owner's token.
4. Track. The reply enters moderation. Check its status and show it to your user. Remove it if needed.

Trust, built in

Every write is checked twice, and moderated once.

1. Display rights: your allowlist. Your Terra account's allowlist decides which Locations you may read and act on. A request for a Location outside it is refused.
2. Action rights: the owner's token. Only a member Tripadvisor has verified as an owner of the Location can reply or report. Your API key alone is not enough. If the member is not a verified owner, the call returns 403.
3. Standard moderation. A reply sent through the API joins the same queue as one typed into Management Center, and is published or rejected by the same rules. No shortcut, no penalty.
4. Reporting stays with Trust & Safety. The report endpoint confirms receipt. Whether a review is removed is Tripadvisor's decision.

Getting started

1. Get access

The kit is an add-on for Terra accounts on the Growth, Scale, or Innovate packages. Speak to your account manager. They will confirm eligibility, the Locations on your allowlist and your expected volume of responses.

2. Register an OAuth client

Send your account team your client name, redirect URIs (one per environment) and the scopes you need, and confirm that you support PKCE. You will receive a client_id. Full details are in OAuth for the Reputation Management Kit.

3. Connect an owner

Run the authorization code flow with PKCE. The owner sees a Tripadvisor consent screen naming your app. If they agree, you exchange the code for an access token. Store it securely, against that owner's account in your platform.

4. Post your first response

Every kit call carries two credentials:

curl --request POST \
  --url https://terra.tripadvisor.com/api/locations/183778/reviews/987654321/owner-responses \
  --header 'X-API-KEY: <your_api_key>' \
  --header 'x-oauth-token: <listing_owner_access_token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "text": "Thank you for flagging the wait at check-in. Friday evening is our busiest hour, and we have added a second desk from 4pm. We hope to welcome you back.",
    "connection": "General Manager",
    "language": "en"
  }'

The response comes back as PENDING_MODERATION. Store the returned id: you need it to check status or remove the reply.

The life of a response

To change a reply, submit a deletion request and submit a new one.

Endpoints at a glance

Rate limits follow your account's package. All errors use the application/problem+json format, with a detail field saying what went wrong.

Building a good integration

Make replying the easy path. Put the reply box next to the review, not three clicks away. Response rates rise when the effort falls.

Show status honestly. Users trust a product that tells them a reply is "In review" rather than implying it is already live. Surface rejections promptly, and say why if you can.

Help users write well. Responses that get published, and that persuade, tend to:

• thank the reviewer and use specifics from the review;
• acknowledge a problem plainly, and say what has changed;
• stay short, courteous and free of jargon;
• be signed with a real role, set in connection (e.g. "General Manager").

They should not include phone numbers, email addresses, links, discount offers or personal details about the reviewer. Responses that do are rejected. Templates are fine as a starting point, but replies that read as boilerplate impress no one.

Prompt for the reviews that matter. Unanswered negative reviews are the costliest. Highlight them, and those still waiting after a few days.

Report sparingly. Reserve reporting for genuine guideline breaches. A merely critical review is not grounds for removal; a good reply serves the business better. Reports are not deduplicated, so stop users from reporting the same review twice.

Handle the owner's token with care. Store it encrypted, scope it to the owner who granted it, and prompt them to reconnect when it expires or is revoked.

What's next: review collection

A revamped Review Collection Widget is under development and will be delivered as part of the Reputation Management Kit seamlessly. Travelers will write their review in an embedded Tripadvisor form on your page, such as a survey thank-you page or a post-stay email landing page. Because the form runs on Tripadvisor, reviews collected this way get the same fraud screening as reviews written on tripadvisor.com.

FAQ

Do owners need a Management Center login?
They need a Tripadvisor account that is a verified owner of the listing. They sign in with it once, during OAuth. After that they work entirely in your product.

Does one connection cover several properties?
Yes. A single authorization covers every listing the owner manages, provided each Location is also on your allowlist.

Can I edit a published reply?
Not directly. Owners can submit for a deletion and submit a new one. The new reply goes through moderation again.

Can my platform reply without the owner's token, using only our API key?
No. Replies must come from a verified owner. The API key establishes which Locations you may act on; the token establishes who is speaking.

Do replies sent through the API get moderated differently?
No. They join the same queue, under the same rules, as replies written in Management Center.

How long does an access token last?

Ask your account team; prompt the owner to reconnect if a call returns 401.

How is the kit priced?
It is a flat-fee add-on set in your enterprise contract-- your account manager can walk you through details based on the scale of properties managed.