API Documentation

Flight search workflow

All flight endpoints require X-Reseller-Id: {resellerGuid}. Search and validation also require Authorization: Bearer <clientToken>.

Request Index

Headers

X-Reseller-Id: 7a73b1a5-91de-4c44-9421-1a5f4db1d321
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

• X-Reseller-Id is validated by RequireResellerIdAttribute.
• Authorization is validated by RequireClientTokenAttribute on search and validation requests.

GET Location Search

Used before flight search to find airport/city tokens for departureId and arrivalId.

GET /api/v1/flights/flight-locations?query=dubai&limit=10

{
  "isSuccess": true,
  "message": "Found 2 locations from 1 providers",
  "errors": {},
  "data": {
    "results": [
      {
        "locationCode": "DXB",
        "locationName": "Dubai International",
        "cityCode": "DXB",
        "cityName": "Dubai",
        "countryName": "United Arab Emirates",
        "type": "Airport"
      }
    ],
    "totalCount": 1,
    "successfulProviders": 1,
    "failedProviders": 0,
    "executionTimeMs": 184
  }
}

POST Flight Search Request

Initial search omits searchCode and cursor. Follow-up paging/cache requests may send the returned values.

{
  "tripType": "RoundTrip",
  "segments": [
    {
      "departureId": "BGW",
      "arrivalId": "DXB",
      "fromDate": "2026-08-20T00:00:00"
    },
    {
      "departureId": "DXB",
      "arrivalId": "BGW",
      "fromDate": "2026-08-27T00:00:00"
    }
  ],
  "adults": 1,
  "children": 0,
  "infants": 0,
  "cabinClass": "Economy",
  "directFlightsOnly": false,
  "flexibleDays": 0,
  "pageSize": 20,
  "currencyCode": "USD"
}

Flight Search Fields

Flight Search Success 200

{
  "isSuccess": true,
  "message": "Success",
  "errors": {},
  "data": {
    "searchCode": "FS-20260711-9f4f",
    "isSearchComplete": true,
    "nextCursor": null,
    "hasMore": false,
    "totalAvailable": 1,
    "successfulProviders": ["Trip Provider"],
    "failedProviders": [],
    "failures": {},
    "totalFlightCount": 1,
    "searchTtlSeconds": 900,
    "flights": [
      {
        "itineraryToken": "eyJzZWFyY2hDb2RlIjoiRlMtMjAyNjA3MTEtOWY0ZiJ9...",
        "provider": {
          "id": "35cc770d-d584-4ae7-8412-651425d6d335",
          "name": "Trip Provider",
          "type": "Trip"
        },
        "price": {
          "total": 420.50,
          "baseFare": 360.00,
          "taxesAndFees": 60.50,
          "currency": "USD"
        },
        "routes": [],
        "totalStops": 0,
        "totalDurationMinutes": 135,
        "cabinClass": "Economy",
        "isRefundable": false,
        "availableSeats": 4
      }
    ]
  }
}

POST Flight Validation Request

Use the itineraryToken from a selected search result. The server decodes it into search code, itinerary code, combination index, and provider ID.

{
  "itineraryToken": "eyJzZWFyY2hDb2RlIjoiRlMtMjAyNjA3MTEtOWY0ZiJ9..."
}

Flight Validation Success 200

{
  "isSuccess": true,
  "message": "Retrieved flight details from Trip Provider",
  "errors": {},
  "data": {
    "executionTimeMs": 312,
    "providerName": "Trip Provider",
    "itineraryToken": "eyJzZWFyY2hDb2RlIjoiRlMtMjAyNjA3MTEtOWY0ZiJ9...",
    "itineraryCode": "ITN-001",
    "searchCode": "FS-20260711-9f4f",
    "flightDetails": {
      "pricing": {
        "totalPrice": 420.50,
        "baseFare": 360.00,
        "serviceFee": 0,
        "currency": "USD",
        "isRefundable": false,
        "upsellSupport": true,
        "passengerFares": []
      },
      "routes": [],
      "fare": { "rules": [] },
      "requirements": {
        "contactRequired": true,
        "documentRequired": true,
        "birthdateRequired": true,
        "frequentFlyerAllowed": false,
        "acceptedDocumentTypes": ["Passport"],
        "birthdateRequiredByPTC": {},
        "contactRequiredByPTC": {}
      },
      "optionalServices": [],
      "payment": {
        "methods": ["Card"],
        "paymentBeforeDays": 0
      }
    }
  }
}

Validation and Errors

Client Workflow

1. Call GET /flights/flight-locations to let the user choose departure and arrival values.
2. Call POST /flights/flights with trip, segment, passenger, cabin, and paging fields.
3. Render returned data.flights and store each itineraryToken.
4. Call POST /flights/validate-flight with the selected token before booking or upsell flows.

API Documentation

Backend CRUD requests

Backends are protected by Authorization: Bearer <token> and require the SuperAdmin role on the API.

Request Index

Create Request

{
  "name": "Main Backend",
  "description": "Primary production backend for active resellers"
}

Update Request

{
  "id": "8149dc90-7554-4140-a961-6ce882242a14",
  "name": "Main Backend",
  "description": "Primary production backend"
}

Success Responses 200 201

{
  "isSuccess": true,
  "message": "Backend created successfully",
  "errors": {},
  "data": {
    "id": "8149dc90-7554-4140-a961-6ce882242a14",
    "name": "Main Backend",
    "description": "Primary production backend",
    "createdAt": "2026-07-11T09:20:00Z",
    "updatedAt": null
  }
}

Validation and Errors

Client Behaviour

• Create and update close the form, reload backends, refresh resellers, and show a toast.
• Deleting a backend reloads backends and resellers so assignment names stay accurate.
• The reseller page uses the same loaded backend list for its Backend select.

API Documentation

Channel CRUD requests

Channels are protected by Authorization: Bearer <token> (channels.view/.create/.update/.delete permissions).

Request Index

Create Request

{
  "code": "WEB",
  "name": "Website",
  "description": "Optional",
  "isActive": true
}

API Documentation

Sales group CRUD requests

Protected by Authorization: Bearer <token> (sales-groups.view/.create/.update/.delete permissions).

Request Index

Create Request

{
  "title": "European resellers",
  "isActive": true,
  "resellerIds": ["..."]
}

API Documentation

Markup rule CRUD requests

Protected by Authorization: Bearer <token> (markups.view/.create/.update/.delete permissions). Platform rules use /platform-markups; reseller-authored rules use /reseller-markups. Each controller fixes the layer server-side.

Request Index

Create Request

{
  "title": "Platform Flight Base Markup",
  "serviceType": "Flight",
  "providerIds": [],
  "resellerIds": [],
  "direction": "Positive",
  "valueType": "FixedAmount",
  "amount": 20,
  "isActive": true,
  "ancillaryMarkupEnabled": false,
  "ancillaryAmount": null,
  "ancillaryValueType": null,
  "criteria": [],
  "isGeneral": true,
  "priority": 1000,
  "appliedOn": "TotalPrice",
  "perPassengerEnabled": false,
  "adultAmount": null, "adultValueType": null,
  "childAmount": null, "childValueType": null,
  "infantAmount": null, "infantValueType": null
}

API Documentation

Currency and exchange-rate CRUD

The page uses the platform-wide endpoints /api/v1/currencies and /api/v1/currencies/exchange-rates. Every exchange-rate row stores the target currency ID and its units-per-USD rate; USD is the implicit source.

Request Index

API Documentation

Enum requests

The enum controller is read-only. These calls return metadata used by admin forms and provider credential validation.

Request Index

Enum Types Response 200

{
  "isSuccess": true,
  "data": [
    { "name": "CabinClass", "value": 1, "description": null },
    { "name": "TripType", "value": 2, "description": null },
    { "name": "ProviderType", "value": 3, "description": null }
  ],
  "message": "Retrieved 8 enum types"
}

Enum Values Response 200

{
  "isSuccess": true,
  "data": {
    "enumType": "ProviderType",
    "items": [
      { "name": "Trip", "value": 0, "description": null },
      { "name": "MontyEsim", "value": 5, "description": null }
    ]
  },
  "message": "Retrieved 2 values for ProviderType"
}

All Enum Types Response (no enumType given) 200

{
  "isSuccess": true,
  "data": {
    "CabinClass": [
      { "name": "Economy", "value": 1, "description": null }
    ],
    "TripType": [
      { "name": "OneWay", "value": 1, "description": null }
    ],
    "ProviderType": [
      { "name": "Trip", "value": 0, "description": null }
    ]
  },
  "message": "Retrieved 8 enum types"
}

Provider Credentials Response 200

[
  "SecretKey",
  "ApplicationId",
  "MarkOrderAsPaidRequest"
]

Available Enum Types

Validation and Errors

API Documentation

Routing rules requests

All routing calls require Authorization: Bearer <token>. Location lookup calls also send X-Reseller-Id, used only to give the autocomplete a credentialed provider context - the saved rule itself is not scoped to that reseller unless it is explicitly checked below.

Request Index

POST Batch Request

Content-Type: application/json. providerIds is required, at least one. resellerIds may be empty - that means the rule targets every reseller.

{
  "rules": [
    {
      "resellerIds": ["7a73b1a5-91de-4c44-9421-1a5f4db1d321"],
      "providerIds": ["35cc770d-d584-4ae7-8412-651425d6d335", "1e088238-1c28-4ad3-b40a-3767f474063e"],
      "serviceType": "Flight",
      "action": "Allow",
      "priority": 1000,
      "departureLocation": "BGW",
      "destinationLocation": "DXB",
      "isEnabled": true,
      "notes": "Prefer these two for BGW-DXB"
    },
    {
      "resellerIds": [],
      "providerIds": ["1e088238-1c28-4ad3-b40a-3767f474063e"],
      "serviceType": "Hotel",
      "action": "Block",
      "priority": 2000,
      "departureLocation": null,
      "destinationLocation": "DXB",
      "isEnabled": true,
      "notes": "Never this supplier for Dubai hotels, any reseller"
    }
  ]
}

Success Responses 200

{
  "isSuccess": true,
  "message": "Rules saved",
  "errors": {},
  "data": [
    {
      "id": "0ef63ad3-8f2b-45e7-b815-2de0d6b044c7",
      "resellerIds": ["7a73b1a5-91de-4c44-9421-1a5f4db1d321"],
      "providerIds": ["35cc770d-d584-4ae7-8412-651425d6d335"],
      "serviceType": "Flight",
      "action": "Allow",
      "priority": 1000,
      "departureLocation": "BGW",
      "destinationLocation": "DXB",
      "isEnabled": true,
      "notes": null
    }
  ]
}

{
  "isSuccess": true,
  "data": {
    "results": [
      {
        "locationCode": "DXB",
        "locationName": "Dubai International",
        "cityCode": "DXB",
        "cityName": "Dubai",
        "countryName": "United Arab Emirates",
        "type": "Airport"
      }
    ]
  }
}

Validation and Errors

Client Behaviour

• Saved rules clear the draft list, reload existing rules, and update the Overview rule count.
• Flight and Insurance rules require both departureLocation and destinationLocation.
• Hotel and ESim rules send departureLocation: null.
• Provider checkboxes are filtered to providers whose categories include the draft's service type; they are not filtered by reseller assignment client-side - an invalid combination is reported by the API and shown as a toast.
• Leaving every reseller checkbox unchecked saves the rule with resellerIds: [], meaning it targets all resellers.
• Country results are cached per selected reseller in state.countries.

API Documentation

Coverage expectation requests

Super-admin only, same bearer token as every other admin call.

Request Index

Detection - not built yet

Consecutive-miss streak: each search where none of the listed airlines came from any of the listed providers increments a counter; any search where they do appear resets it to zero. Hitting consecutiveMissThreshold fires a notification to the holders of the technical-notification permission. Apply the cooldown. When the cooldown expires, re-check - if still missing, fire again. This screen only stores the declaration; nothing evaluates it yet.

API Documentation

Search execution log requests

Super-admin only, same bearer token as every other admin call. Read-only - rows are written by a background consumer, never through this endpoint.

Request Index

Reading the Stage column

ScopedOnly: an Allow rule scoped this search and stage 1 found something. PublicOnly: no Allow rule matched at all, so every eligible provider was searched directly - this is normal, not a failure signal. PublicFallback: an Allow rule scoped this search, stage 1 ran and found nothing usable, so the unrestricted stage 2 also ran. Parallel: the engine setting to run both stages together was on.

API Documentation

Audit log requests

Read-only. Needs the logs.view permission.

API Documentation

Application log requests

Read-only. Needs the logs.view permission.

API Documentation

Order requests

Super-admin only, same bearer token as every other admin call. Read-only - rows are written by the create-order/reserve flow, never through this endpoint.

Request Index

API Documentation

Reseller CRUD requests

All reseller requests require Authorization: Bearer <token> and use the standard Result<T> response envelope.

Request Index

Create Request

{
  "name": "Acme Travel",
  "status": "Active",
  "backendId": "8149dc90-7554-4140-a961-6ce882242a14",
  "providers": [
    {
      "providerId": "35cc770d-d584-4ae7-8412-651425d6d335",
      "status": "Active",
      "assignedCategories": "Flight, Hotel",
      "extraInfo": "{\"market\":\"IQ\"}"
    }
  ]
}

Update Request

{
  "id": "7a73b1a5-91de-4c44-9421-1a5f4db1d321",
  "name": "Acme Travel",
  "status": "Inactive",
  "backendId": null,
  "providers": [
    {
      "providerId": "35cc770d-d584-4ae7-8412-651425d6d335",
      "status": "Active",
      "assignedCategories": "Flight",
      "extraInfo": ""
    }
  ]
}

Success Response 200

{
  "isSuccess": true,
  "message": "Reseller saved",
  "errors": {},
  "data": {
    "id": "7a73b1a5-91de-4c44-9421-1a5f4db1d321",
    "name": "Acme Travel",
    "backendId": "8149dc90-7554-4140-a961-6ce882242a14",
    "backendName": "Main Backend",
    "status": "Active",
    "createdAt": "2026-07-11T09:20:00Z",
    "providers": [
      {
        "providerId": "35cc770d-d584-4ae7-8412-651425d6d335",
        "providerName": "Trip Provider",
        "status": "Active",
        "assignedCategories": "Flight, Hotel"
      }
    ]
  }
}

Validation and Errors

Client Behaviour

• Create and update close the form, reload resellers, and show a toast.
• Deleting the active reseller clears the global reseller selector.
• Provider assignments are rebuilt from the latest provider list each time the form opens.
• backendId is sent as null when No backend is selected.

API Documentation

Provider CRUD requests

All provider requests require Authorization: Bearer <token>. The UI sends enum values as numbers and category selections as a bitmask.

Request Index

Create Request

{
  "name": "Trip Provider",
  "status": 0,
  "type": 0,
  "carrierDisplay": 0,
  "categories": 3,
  "url": "https://supplier.example.com/api",
  "credentials": "{\"ApplicationId\":\"app-id\",\"ApplicationSecret\":\"secret\"}"
}

Update and Status Requests

{
  "id": "35cc770d-d584-4ae7-8412-651425d6d335",
  "name": "Trip Provider",
  "status": 0,
  "type": 0,
  "carrierDisplay": 1,
  "categories": 1027,
  "url": "https://supplier.example.com/api",
  "credentials": ""
}

{
  "id": "35cc770d-d584-4ae7-8412-651425d6d335",
  "status": 1
}

Success Response 200

{
  "isSuccess": true,
  "message": "Provider saved",
  "errors": {},
  "data": {
    "id": "35cc770d-d584-4ae7-8412-651425d6d335",
    "name": "Trip Provider",
    "type": "Trip",
    "status": "Active",
    "carrierDisplay": "Marketing",
    "categories": "Flight, Hotel",
    "url": "https://supplier.example.com/api"
  }
}

Validation and Errors

Client Behaviour

• Create, update, delete, and status changes reload providers and resellers.
• Credentials are entered as one input per key. The required keys come from GET /api/v1/enums/provider-credentials/{providerType}; the API never returns credential values, only the names of the keys that are set (credentialKeys). When editing, only the fields that are filled in are sent and only those keys change.
• Status toggles send the next numeric status only: 0 for activate and 1 for deactivate.
• Provider categories are displayed as names but submitted as the summed bitmask value.

API Documentation

Roles & users requests

Each request below requires Authorization: Bearer <token> from an account holding its own specific permission (e.g. roles.create, users.delete) - not one blanket permission for the whole module. Every legacy SuperAdmin is granted all of them automatically.

Request Index

Create User Request

{
  "name": "Jordan Lee",
  "email": "jordan@bookingadvisor.com",
  "password": "P@ssw0rd",
  "roleIds": ["8149dc90-7554-4140-a961-6ce882242a14"]
}

Create/Update Role Request

{
  "name": "Provider Managers",
  "description": "Can manage provider records and routing rules",
  "isActive": true,
  "permissionIds": ["8149dc90-7554-4140-a961-6ce882242a14"]
}

Role Success Response 200 201

{
  "isSuccess": true,
  "message": "Role created successfully",
  "errors": {},
  "data": {
    "id": "8149dc90-7554-4140-a961-6ce882242a14",
    "name": "Provider Managers",
    "description": "Can manage provider records and routing rules",
    "isActive": true,
    "permissionIds": ["8149dc90-7554-4140-a961-6ce882242a14"]
  }
}

User List Response 200

{
  "isSuccess": true,
  "message": "OK",
  "errors": {},
  "data": [
    {
      "id": "8149dc90-7554-4140-a961-6ce882242a14",
      "name": "Admin User",
      "email": "admin@bookingadvisor.com",
      "role": "SuperAdmin",
      "roleIds": ["a1b2c3d4-0000-0000-0000-000000000000"],
      "roleNames": ["Super Admin"]
    }
  ]
}