Conventions

Transport and encoding

HTTPS only. Requests are POST with Content-Type: application/json, except order status, which is a GET with no body. Every response is JSON.
Property names are camelCase, including dictionary keys (baggage per passenger type is keyed adult, child, infant).
Enumerations are strings in responses ("tripType": "RoundTrip"). Requests accept the name ("Economy") or the number (1). See Enumerations.
Search and offer ids are GUIDs. Order ids are integers.
Offers carry IATA codes for airlines and airports. Their English names come once per response in the dictionaries block.
Optional fields with no value are omitted from the JSON rather than sent as null.
Money is decimal, in the offer’s price.currency.

Dates and times

Kind	Format	Example
Flight times	Local airport time, no offset	`2026-12-07T03:00:00`
Date-only fields	`yyyy-MM-dd`	`2026-12-07`
Durations	Integer minutes	`150`

Headers

Header	Direction	Required	Description
`Authorization: Bearer {token}`	Request	Yes, except authenticate	Token from authenticate
`Content-Type: application/json`	Request	Yes
`X-Correlation-Id`	Both	Recommended	Your request id: letters, digits, `. _ : -`, up to 64 characters. Echoed back, generated when absent. Quote it in support requests.
`X-Api-Version`	Request	No	Alternative to the `/v1/` path segment

Responses

A successful call (HTTP 200) returns the resource directly, with no wrapper. A failed call (4xx or 5xx) returns the error envelope:

{
  "success": false,
  "data": null,
  "error": {
    "errorCode": "FLIGHT_PRICE_CHANGED",
    "errorMessage": "Flight price has changed. Please search again and review the new price before booking.",
    "errorCategory": "Conflict",
    "httpStatusCode": 409,
    "correlationId": "7b1c8f1e-4d2a-4f3e-9a7b-1c2d3e4f5a6b",
    "timestamp": "2026-10-25T07:22:46.158Z",
    "errorDetails": { "oldTotalPrice": 412.50, "newTotalPrice": 436.00 },
    "validationErrors": [],
    "suggestedAction": "Search again and book the refreshed offer.",
    "documentationUrl": null
  },
  "correlationId": "7b1c8f1e-4d2a-4f3e-9a7b-1c2d3e4f5a6b",
  "timestamp": "2026-10-25T07:22:46.158Z"
}

string

Stable machine-readable code. Branch on this, never on the message. Full list in Errors.

string

English text for humans. It may change, so don’t parse it.

string

One of Validation, Authentication, NotFound, Conflict, Payment, Provider, Timeout, RateLimit, System, BusinessRule.

integer

Same as the HTTP status.

object

Optional context. For validation failures it maps field names to lists of messages.

string

What to do next.

string

Trace id for support.

Validation failures

HTTP 400 always uses INVALID_REQUEST_FORMAT and names each offending field:

"errorDetails": {
  "segments": ["RoundTrip searches take exactly two segments: the outbound and the return."],
  "flightPassengers[0].passportNumber": ["PassportNumber is required for passport travellers."]
}

Get started

Platform

Transport and encoding

Dates and times

Headers

Responses

Validation failures

​Transport and encoding

​Dates and times

​Headers

​Responses

​Validation failures

Transport and encoding

Dates and times

Headers

Responses

Validation failures