What happens if the hotel turns out to be full after my customer has already paid on my portal?

Yes, this can happen, although it is uncommon. Hotel availability through an API is a live picture of what the supplier is holding at that moment, and that picture can change in the seconds between your customer seeing a room and pressing the pay button. If someone else takes the last room first, or the hotel closes out that rate, the supplier will decline the booking even though the search result looked fine a moment earlier.

When that happens the API does not return a confirmation number. Instead it returns a failure or a rejection, and the booking is recorded in your system as unconfirmed rather than confirmed. That is an important difference, because it means you are never left guessing whether a reservation exists. You should treat a booking as real only when you have the supplier confirmation reference back, not when the payment has gone through.

What happens to the money depends on how you have set up payment and on the supplier involved. If the card was only authorised and not captured, the authorisation can usually be released. If it was captured, you will normally be refunding the customer or putting the amount towards an alternative hotel. Some suppliers also work on request, which means the booking sits pending until the hotel replies, and in that case you will need to tell your customer that it is not final yet. Your portal can be set up to offer similar hotels straight away so the customer is not left with nothing.

It is worth testing a failed booking with your supplier before you go live, and agreeing with your payment provider how authorisations and refunds should be handled.