Step 3b Teardown — Viator/Tripadvisor · KKday/rezio · Headout

Compiled 2026-07-26. Tiers: A = filings, IR, earnings transcripts, official docs, live product · B = credible trade press · C = blogs, LinkedIn, vendor marketing. Status markers: [SHIPPED] = observably live · [ANNOUNCED] = stated, not verified live · [SPECULATION] = inference, labelled.

0. Grounding corrections to the brief

1. AI MATURITY

Scale: 0 absent · 1 rules · 2 classical ML · 3 GenAI-assisted · 4 agentic (system takes multi-step action against a goal without a human in the loop).

1.1 Viator / Tripadvisor

Sources: Q4 2025 earnings call (2026-02-12) and Q1 2026 earnings call (2026-05-07/08) — both Tier A. docs.viator.com/partner-api/technical (live, Tier A). Certification pages at partnerresources.viator.com (live, Tier A).

Shape of it: Tripadvisor is a 3 on the consumer surface and a 1 on the supply/B2B surface. Every named, dated AI shipment faces the traveller or the LLM. Nothing AI-shaped has been shipped into ingestion, availability, pricing, partner onboarding or the connectivity API. The one supply-side exception (AI-assisted sign-up) is the one whose segment attribution is ambiguous.

1.2 KKday / rezio

⚠️ Tier-A AI evidence is close to nil. KKday is private with no earnings calls; the rezio marketing site, pricing page and the full 752 KB OpenAPI spec contain zero AI features, zero AI endpoints and no AI SKU. I am not scoring stages on absence of marketing copy; I am scoring on absence of any observable artefact in the products I could inspect.

Shape of it: rezio is a 1 across the board with an unusually high automation ceiling. It is the most programmable supplier backend in this teardown and the least intelligent. Everything an AI layer would need — write access to products, sessions, prices, seats, orders — is already exposed. Nobody has put an AI layer on it.

1.3 Headout — cautionary case

Shape of it: Headout has an AI narrative with no named shipped feature and a public API that visibly stopped being maintained. Nothing here is falsified — the claims may all be true internally — but from outside, the entire AI posture is Tier-A-source vendor prose. The Dabble acqui-hire is the sharpest signal: 26 months, no shipped output. Two years is long enough that the honest reading is a talent absorption, not a product roadmap.

2. B2B DISTRIBUTION TEARDOWN

2.1 Viator Partner API v2.0 — the industry default, read properly

Surface. 33 endpoints, Redocly-rendered, downloadable OpenAPI spec, CC BY 4.0. Last spec change 2026-05-05 (product-option-level logistics object) — actively maintained.

Auth. Single header exp-api-key. No OAuth, no rotation flow documented. Key issued by "your business development account manager" — there is no self-serve key.

Tiering — four levels, with a published endpoint × tier matrix (Tier A):

🔴 Read this matrix carefully — it is a commercial instrument disguised as a permissions table. The catalogue you need to run a real storefront (/products/modified-since + /availability/schedules/modified-since) is denied at Basic. You cannot even build a competent catalogue without being commercially promoted first. And Merchant is denied the Payments endpoint precisely because a merchant of record processes its own money.

Invoicing currency asymmetry. Merchants may be invoiced in GBP, EUR, USD, CAD, AUD only — five. Affiliates may transact in 27 currencies including IDR. 🔴 IDR is not a merchant invoicing currency. An Indonesian merchant partner carries the full USD/IDR exposure between booking and settlement. This is a real, quantifiable cost, not a technicality.

Rate limits. Per API key, rolling 10-second window (worked example in docs: RateLimit-Limit: 16, i.e. 16 req/10 s on that endpoint). HTTP 429 returns RateLimit-Limit/-Remaining/-Reset/Retry-After. Separately, a system-wide concurrency limiter can return HTTP 503 + Retry-After: 60 even when you are within your own quota — you can be throttled for someone else's traffic. Endpoint timeout: minimum 120 s required on the partner side.

Ingestion contract — mandated, not advisory. These cadences are cert-enforced:

Explicitly prohibited: using /products/search or /search/freetext for ingestion; using /availability/check for ingestion; full re-ingestion when a delta would do; >50 results per search page; >500 location refs per /locations/bulk; placing a booking hold to check availability ("holds only with strong intention to purchase").

Sandbox. Yes, and it is honest about its own limits. Manual-confirmation products return CONFIRMED by default; you must set header exp-demo: false to get realistic PENDING. 🔴 To drive the booking to a final CONFIRMED or REJECTED you must email apitechsupport@viator.com with the bookingRef and ask a human to flip it. The manual-confirmation lifecycle — the exact path that matters most for long-tail supply — cannot be tested end-to-end without a human in Viator's loop.

Certification — actual steps and what it gates. Two forms (back-end and front-end) emailed to affiliateapi@tripadvisor.com. Feedback in "a couple of days" per round. Gates go-live.

Back-end checks: ingestion-cadence adherence · delta-only discipline · no search-as-ingestion · mandatory real-time /availability/check after date+pax selection and before booking · hold discipline and hold-expiry handling · currency in the supported list · payment integration (either PARTNER_FORM token flow with x-trip-clientid/x-trip-requestid headers and JS device fingerprint, or the Viator iframe with onSubmitSuccess/onSubmitError) · booking-ref/hold-ref consistency · fraud fields populated · ≥120 s timeouts · status polling at ≥1-min intervals, hourly for PENDING · cancellation via cancel-quote before cancel with a reason from /bookings/cancel-reasons · supplier-cancellation ingestion every 5 min + acknowledge · PCI DSS compliance.

Front-end checks — this is the part people underestimate: you must ship four search methods (destination, attraction, product code, freetext); eight filters (category/tags, attraction, price, review rating, duration, time of day, cancellation policy, special offers, plus "likely to sell out"/"excellent quality"); five sort orders with DEFAULT as the default; clickable country→region→city breadcrumbs; eleven mandatory product-detail fields (title, images, description, inclusions, exclusions, additionalInfo, cancellationPolicy, languageGuides, itinerary, ticketInfo, logistics.start/end); age-band display with startAge/endAge and enforcement of per-band and per-booking min/max plus requiresAdultForBooking; a calendar built from bookableSeasons minus unavailableDates across overlapping bookable items with lowest-ADULT-price fallback chain (SENIOR→YOUTH→CHILD→INFANT); UNIT vs PER_PERSON pricing maths; conditional booking-question logic including the TRANSFER_ARRIVAL_MODE → pickup-type tree (docs note >50% of Viator products offer pickup, and explicitly tell you not to exclude them); verbatim cancellation-policy text; all reviews displayed, not selectively, with provider attribution; a confirmed live test booking and a live test cancellation; voucher delivery; HTTPS; Viator branding compliance.

🔴 Two front-end rules are strategically decisive, not cosmetic:

1. "Protected Viator unique content must not be indexed" — attraction data and reviews must be rendered non-indexable. The API contractually denies you SEO value from Viator's content. You may resell the inventory; you may not rank on it.
2. Merchant price floor: "Partner prices ≥ partnerTotalPrice (unless intentional discount)" — a cost floor, not rate parity. Viator does not force you to match its retail price. There is no rate-parity clause in the certification requirements.

Commercial model. Merchant partners are merchant of record, own all monetary transactions, own customer support, and are "invoiced periodically by Viator for all product sales" — i.e. a credit line, not prepay; amount and terms undisclosed. Qualification requires demonstrating "access to the appropriate infrastructure to effectively support the requisite business operations." Merchants may set their own cancellation terms but are invoiced on Viator's — so any consumer-friendly refund policy you offer is funded off your own balance sheet. Docs note ~85% of products are STANDARD (24 h free cancellation, 100% penalty inside 24 h).

Channel-conflict stance. Structurally permissive, commercially self-serving. Affiliates are redirected to viator.com and paid a cookie commission — pure channel conflict, by design. Merchants sell in their own storefront under their own brand at their own price with only a net-cost floor — minimal price conflict. The conflict Viator actually manages is SEO, not price: the non-indexing rule ensures a merchant partner can never out-rank Viator on Viator's own content.

Time-to-first-booking. Registration → qualification (Viator decides which program you get) → development → certification (two forms, iterative, "couple of days" per round) → Viator-side production config incl. product mapping → scheduled go-live "initially for a small number of products". No self-serve path exists at any step. Realistic: weeks to months, gated on a human account manager throughout.

Where AI appears in the B2B surface. 🔴 Nowhere. One POST /products/recommendations endpoint of undisclosed method. /search/freetext is keyword. No semantic search, no MCP server, no tool manifest, no natural-language endpoint, no agentic booking flow. The most AI-forward consumer company in this teardown ships a completely pre-LLM B2B API. Its agentic exposure is entirely outbound — being a callable app inside ChatGPT — and its partners get none of it.

2.2 rezio Open API — the inverse of Viator

Surface. OpenAPI 3.0.3, api.rezio.io v1.0.0, ~60 operations, rendered with Scalar, spec at developer.rezio.io/sources/open-api/en.yaml (752 KB), EN + zh-TW. Public, no login.

Auth. X-Auth-StoreUuid (your store UUID) + X-Auth-Key (from admin.rezio.io) + X-Lang. Store-scoped — the API can only ever see one operator's own data.

Groups: System (/v1/config, /v1/dataOption) · Shared Settings — 9 reusable objects each with list/create/get/update (pricePolicy, feeNdTax, cancelPolicy, depositPolicy, bookingInfo, bookingField, pickup, extra, resource) · Products (list, detail, salesOption, mediaInfo, create, plus 18 PUT sub-resources) · Publish (sessionSetting create/get/update, session get/update price & seats, session/{uuid}/active, calendar) · Orders (list, detail, create, status, payment note, note, contact, bookingInfo) · GET /v1/redeem/list · POST /webhook (product events).

🔴 What is conspicuously absent tells you what rezio is. There is no distributor catalogue search, no net-rate/contract endpoint, no commission object, no cross-store discovery. This is not a distribution feed. It is an operator-side back-office write API — an ERP for one store. You cannot source inventory through it.

So how does rezio distribute? Through the first-party Channel Manager, a UI-configured feature that pushes an operator's products to KKday, GetYourGuide and Viator — gated at the PLUS plan. The Open API builds the catalogue; the Channel Manager sells it. The two never touch.

Onboarding, sandbox, time-to-first-call. Upgrade plan → collect key from the admin console. No certification. No documented sandbox. No approval queue. Days, on a credit card. But the "first booking" it produces lands in your own store, not in a marketplace — so it is not comparable to Viator's time-to-first-booking at all.

Where AI appears. Zero occurrences in the spec, the pricing page or the site.

Head-to-head:

2.3 Headout — brief

github.com/headout/api-docs public, last pushed 2024-07-29 (~24 months stale). partner.headout.com = affiliate program. Supply funnel = hub.headout.com. Terms are hosted at hub.headout.com/terms-and-conditions/. Tiering, credit terms, certification, sandbox and time-to-first-booking: all unverified — there is no maintained public artefact to read. That absence is itself the finding: a stale public API repo is a costless, high-fidelity signal that a company's B2B distribution is not a priority, because keeping docs current is the cheapest thing a serious API programme does.

3. 🔴 rezio — "build the plumbing and sell it": does it work as a business?

The precedent, stated precisely. rezio is the only case in this study where a marketplace productised its supplier backend as a separately-priced, publicly-marketed SaaS whose channel manager distributes to the parent's direct competitors — GetYourGuide and Viator. Not as a concession. As a headline feature.

Commercial model (Tier A, rezio.io/pricing, live 2026-07-26):

⚠️ The page also shows US$59 / US$119 / US$259 columns labelled as the annual-plan monthly rate, which read higher than the monthly prices — the presentation is internally contradictory. Quote the tier structure and the ~US$50/100/217 ladder; do not assert an annual discount.

No commission. No transaction fee. No take rate. No setup fee. No free tier. Pure subscription.

Does it work as a revenue business? Almost certainly not — and the arithmetic is not close.

• Disclosed scale: 5,000+ operators across TW/HK/JP/KR/SG/MY/TH/VN.
• All-PLUS ceiling: 5,000 × US$99.90 × 12 ≈ US$6.0M ARR.
• Implausible all-SCALE ceiling: 5,000 × US$216.60 × 12 ≈ US$13.0M ARR.
• Against KKday's ~US$70M Series D (2024-12-05).

[SPECULATION, labelled] A realistic blend skewed to BASE/PLUS lands nearer US$4–5M ARR — a rounding error against a company that just raised US$70M, and one that a direct sales team calling on eight markets would struggle to cover, let alone profit from. rezio has no separate legal entity (it trades as Kkday.com International Company Limited), no separately reported revenue, and no separate P&L in anything public.

Verdict: rezio is a supply-acquisition subsidy with SaaS cost recovery, not a revenue line. The subscription exists to make the operator feel like a customer rather than a captured supplier, and to filter out operators too small to matter. What KKday buys for ~US$1,200/operator/year is far more valuable than the US$1,200: the operator's system of record — true availability, true cost price, true order state, live, first-party, continuously.

And the competitor-distribution question answers itself. rezio must push to GetYourGuide and Viator. An operator will not run their entire business on a booking system that only sells to one OTA — that is a channel, not a system of record. Multi-channel distribution is the price of admission to the operator's back office. KKday pays that price knowingly, because the position it buys is structurally better than exclusivity: KKday sees the operator's real inventory and real cost basis in real time, and is the default, zero-friction, already-configured channel. Every competitor reached through rezio is reached through a pipe KKday owns, on data KKday already has.

🔴 The transferable lesson is the inversion. The plumbing is not the product and it is not the revenue. The plumbing is the customer-acquisition cost, and the data position is the return. Anyone evaluating "build the plumbing and sell it" as a business is reading the precedent backwards. The only known instance of it prices at roughly cost and books no separate revenue.

4. 🔴 Viator's real economics — and the Klook cross-check

4.1 What the activists actually disclosed

Honest finding first: the activist filings are weaker on unit economics than the brief anticipated. Palliser's campaign (public 2025-08-05, Bloomberg/Boston Globe; Skift 2025-08-20) is a sum-of-the-parts valuation argument, not a margin disclosure. It discloses Palliser's position, not Viator's cost structure.

Starboard Value (~9%, letter 2026-02-17, settled via board expansion) likewise produced no segment-margin disclosure I could verify.

🔴 The correction to the brief's premise: the richest public source on whether a TAA marketplace is a good business is not the activist deck. It is Tripadvisor's own segment reporting — which the activists are pointing at, not supplementing. Segment disclosure is good enough that the activists do not need to add to it.

4.2 The actual numbers (Tier A — Tripadvisor Q4 2025 and Q1 2026 earnings calls)

Company-level context (stockanalysis.com, FY2025): revenue US$1,891M, gross profit US$1,746M, gross margin 92.3%, operating income US$80M, net income US$40M.

4.3 🔴 The one number that answers the question

Viator converts a 19.7% take rate into a 1.94% EBITDA margin on GBV.

~90% of the take rate is consumed before it reaches EBITDA. At the scale of 425,000 products, 70,000 suppliers and US$4.7B of GBV — the largest pure-play tours-and-activities marketplace in the world, twenty-plus years in — the business retains under two cents of every dollar booked.

And the seasonality is brutal in a way the annual figure hides: Q1 2026 Experiences ran a −11% EBITDA margin. A business whose peak-quarter margin is 7% of revenue and whose trough quarter is negative has almost no absorptive capacity for a bad season. Note also that Q1 2026 revenue grew 8% headline but only 4% in constant currency — half the growth was FX.

4.4 Cross-check against Klook (F-1: gross profit = 11.2% of GTV)

They do not agree — Viator's is roughly 1.6× Klook's. Three reasons, and only the third is comforting:

1. Geography and product mix. Viator is North America/Europe-weighted, dominated by high-take third-party tours. Klook is Asia-weighted with heavy volume in low-take transport, attraction passes and rail — categories that carry a few points of margin, not twenty.
2. ⚠️ Accounting is not comparable. Tripadvisor's cost of revenue is thin (7.7% of revenue) and excludes all sales and marketing. Klook's gross profit line, per its F-1, sits after payment processing and elements of fulfilment. Klook's 11.2% and Viator's 18.2% are not the same line item. Treat this as directional only.
3. The comparison that is clean, and the one that matters: both companies end up in the low single digits of GBV at the profit line. Viator's 1.94% EBITDA/GBV at US$4.7B scale is the honest floor of what this business model yields. The gross-profit gap is real but it is not where the economics are decided — marketing is.

4.5 What this means about the model

[SPECULATION, labelled — inference from Tier A figures, not a disclosed statement] The gap between a 19.7% take rate and a 1.94% EBITDA margin is almost entirely demand acquisition. Every disclosed strategic move confirms this is the binding constraint: pushing SEO below 10% of GBV, growing direct and app fastest, celebrating repeat cohorts with "lower acquisition costs beyond their first booking", and chasing AI channels because their conversion is "among the highest of any channel." All four are the same move — escape paid acquisition. Tripadvisor's AI strategy is not, at root, a product strategy. It is a CAC strategy, and the 1.94% is why.

5. Closing — one line per company

Directions per 00-scope.md: D0 curated Pass · D1 horizontal catalog · D2 partner dashboard · D3 reseller API. These are notes with reasons, not recommendations.

Viator / Tripadvisor → the strongest available argument against D1 at SatuSatu's scale, and a specific warning on D3. The world's largest TAA marketplace runs a 19.7% take rate down to 1.94% of GBV, went EBITDA-negative in Q1 2026, and is being publicly dismantled by two activists over exactly that — so a horizontal catalog (D1) built on Pool A's ~10% gross / ~7% post-payments has less take rate than Viator and would have to beat Viator at the one thing consuming Viator's entire spread, which is paid demand acquisition. On D3: Viator's certification is ~90 published checks including a full merchandising front-end, a live test booking and cancellation, PCI DSS, and a rule that its content must be non-indexable — that is the industry default a SatuSatu reseller API would be benchmarked against with no dedicated engineering capacity, and IDR is not even an accepted merchant invoicing currency.

KKday / rezio → the precedent that reframes D2, and the only one that survives contact with SatuSatu's constraints. rezio proves a marketplace can put its supplier backend in front of operators and win their system of record, but it also proves the price of that: ~US$50–217/month, no commission, no separate entity, no separate revenue, a ceiling around US$6M ARR on 5,000+ operators — a partner dashboard is a supply-acquisition subsidy, not a revenue line, and it only works if it distributes to your competitors too. The transferable read for D2 is that the return is the data position on Pool B's 27%-margin direct-contracted Balinese operators — their real availability and real cost basis — and if D2 is justified on subscription revenue instead, the only known precedent says the arithmetic does not clear.

Headout → the cautionary case that prices the maintenance burden SatuSatu has no capacity to carry. A profitable, US$130M-revenue, 400+-city company that acqui-hired an AI team in mid-2024 has shipped no named AI feature in 26 months and let its public API docs go ~24 months stale — and Headout has engineers. With zero dedicated engineering capacity, SatuSatu should read a stale API repo as the expected end state of any D3 build it undertakes, and weight buy/partner accordingly; the AI posture (Dabble's computer-vision/spatial bet, not an LLM bet) is also the one direction in this teardown that nobody has validated.