# Travnet Search Engine (TSE) > A multi-supplier travel platform by Sitenet Tech for travel enterprises and tour operators. > Search. Book. Manage. Flight, hotel and transport search across multiple GDS and aggregator > suppliers, followed by booking, ticketing, payment and post-sale servicing, plus admin, > agency and traveller management surfaces. ## Hosts - Production: `https://api.travnet.app` - Test: `https://test.travnet.app` - Console and reference: `https://developers.travnet.app` ## Authentication Supabase-backed JWT bearer tokens. 1. `POST /api/v1/auth/login` with `{"email": "...", "password": "..."}` 2. Read `access_token` from the response. 3. Send `Authorization: Bearer ` on every subsequent request. Guard levels used below: - `role` — restricted to a specific role via RoleGuard (super_admin, company_admin, company_staff, customer) - `user` — any authenticated caller - `none` — no authentication required - `tenant` — additionally scoped to the caller's company - `idem` — requires an `Idempotency-Key` request header - `sse` — responds with `text/event-stream`, not JSON ## Conventions - All monetary amounts are integers in MINOR units (45000 = 450.00) on fields suffixed `_minor`. - Currencies: GBP, USD, EUR, BDT, SAR, AED, BHD, QAR, KWD, OMR, PKR, INR, MYR, SGD, LKR. - Dates are ISO 8601 (`YYYY-MM-DD`); timestamps are RFC 3339 UTC. - List endpoints take `page` and `page_size`, and usually `sort_by` / `sort_order`. - Any operation that creates or moves money requires an `Idempotency-Key`; reuse of a key returns the original result rather than repeating the effect. - Search is asynchronous: POST a search, receive a `search_id`, then either poll the `batch` endpoint or consume the SSE `stream` endpoint. ## Machine-readable - OpenAPI 3.1 schema: https://developers.travnet.app/openapi.json - Full endpoint reference: https://developers.travnet.app/llms-full.txt ## Endpoints ### Search (16) #### Flight search - `POST /api/v1/flight/getFare` [user] — Initiate flight search - Initiates a new flight search request. Serializes dates, enriches with user ID, and triggers async search pipeline. - body (FlightSearchRequest): currency: string; companyCode*: string; userCode*: string; adults: number; children: number; infants: number; childAge: array; journeyType: enum(Return|OneWay|MultiCity); cabinClass: enum(Economy|Premium|Business|First); airline: string; searchAirLegs*: array; sources: array; fareType: array; corporateCodes: array; refundableFare: bool; brandedFares: bool; addOneWayOffers: bool - `GET /api/v1/flight/getFare/batch/{search_id}` [user] — Get all results at once (batch mode) - Wait for all GDS to complete (or timeout) and return complete result set. - path: search_id*: string - query: timeout: number - `GET /api/v1/flight/getFare/stream-by-gds/{search_id}` [user, sse] — Stream flight results grouped by GDS - Server-Sent Events stream delivering results as each GDS completes. - path: search_id*: string - `GET /api/v1/flight/getFare/stream/{search_id}` [user, sse] — Stream flight search results - Server-Sent Events stream delivering real-time offers and updates. - path: search_id*: string - query: Last-Event-ID: string #### Hotel search - `POST /api/v1/hotel/search` [user] — Initiate hotel availability search - Search available hotels across multiple providers (Amadeus Self-Service, Amadeus Enterprise). Returns a search_id and stream URLs for 3 consumption modes: 1. **SSE off - body (HotelSearchRequest): destination*: string; check_in*: string; check_out*: string; rooms: array; nationality: string; currency: string; min_star_rating: number; max_results: number; sort_by: enum(price_asc|price_desc|star_rating|distance); company_code*: string; user_code*: string - `GET /api/v1/hotel/search/batch/{search_id}` [user] — Get all hotel results at once (batch mode) - Wait for all providers to complete (or timeout) and return complete result set. **Timeout Behavior:** - Returns HTTP 200 if all providers complete within timeout - - path: search_id*: string - query: timeout: number - `GET /api/v1/hotel/search/results/{search_id}` [user] — Poll hotel search results - Simple polling endpoint — returns current results + status. Supports filtering by price/star rating and pagination. For real-time updates, use the SSE stream endpoints inst - path: search_id*: string - query: page: number; page_size: number; min_price: number; max_price: number; min_stars: number; sort_by: string - `GET /api/v1/hotel/search/stream-by-provider/{search_id}` [user, sse] — Stream hotel results grouped by provider - Server-Sent Events stream delivering complete result sets as each provider finishes. **Events:** - `provider_results`: Complete offer array from a provider - `hear - path: search_id*: string - `GET /api/v1/hotel/search/stream/{search_id}` [user, sse] — Stream hotel offers via SSE (offer-by-offer) - Server-Sent Events stream delivering individual hotel offers in real-time. Each offer is pushed immediately as it arrives from providers. **Events:** - `hotel_offe - path: search_id*: string #### Reference data - `GET /api/v1/airlines/search` [none] — Search Airlines - Search airlines for autocomplete functionality. This endpoint provides intelligent airline search with: - Text and exact IATA/ICAO code matching - Country-based filtering - Advanc - query: query*: string; limit: number; country: string - `GET /api/v1/airports/search` [none] — Search Airports - Search airports for autocomplete functionality with geographic capabilities. This endpoint provides intelligent airport search with: - Text and exact IATA (3-letter)/ICAO (4-lette - query: query*: string; limit: number; country: string #### Transport search - `POST /api/v1/transport/search` [user] — Initiate ground transport search - Search available transfers across multiple providers (Jayride, GetTransfer, HolidayTaxis). Returns a search_id and stream URLs for 3 consumption modes: 1. **SSE offer- - body (TransportSearchRequest): pickup_location*: string; dropoff_location*: string; pickup_datetime*: string; passengers: number; luggage: number; return_datetime: string; transfer_type: string; currency: string - `GET /api/v1/transport/search/batch/{search_id}` [user] — Get all transport results at once (batch mode) - Wait for all providers to complete (or timeout) and return complete result set. - path: search_id*: string - query: timeout: number - `GET /api/v1/transport/search/results/{search_id}` [user] — Poll transport search results - Simple polling endpoint — returns current results + status. - path: search_id*: string - query: page: number; page_size: number; min_price: number; max_price: number; transfer_type: string; vehicle_category: string; sort_by: string - `GET /api/v1/transport/search/stream-by-provider/{search_id}` [user, sse] — Stream transport results grouped by provider - Server-Sent Events stream delivering complete result sets as each provider finishes. **Events:** - `provider_results`: Complete offer array from a provider - `hear - path: search_id*: string - `GET /api/v1/transport/search/stream/{search_id}` [user, sse] — Stream transport offers via SSE (offer-by-offer) - Server-Sent Events stream delivering individual transfer offers in real-time. **Events:** - `transport_offer`: Individual transfer offer data - `heartbeat`: Keep-a - path: search_id*: string ### Operations (44) #### Ancillaries - `POST /api/v1/bookings/{booking_id}/ancillaries` [user] — Add an ancillary SSR (extra baggage, meal, wheelchair…) - Add a Special Service Request to a booked PNR — e.g. **XBAG** (extra baggage), **MOML** (meal), **WCHR** (wheelchair). **Query params** - `ssr_code`: SSR code, e.g. `X - path: booking_id*: string - query: ssr_code*: string; free_text: string; segment_id: string; passenger_id: string - `POST /api/v1/bookings/{booking_id}/ancillaries/cancel` [user] — Cancel paid ancillaries (void EMD or remove the element) - Completes the ancillary lifecycle: **catalogue → purchase (hold) → EMD (confirm) → cancel**. The right Amadeus message depends on how far the ancillary got, and the server - path: booking_id*: string - `GET /api/v1/bookings/{booking_id}/ancillaries/catalogue` [user] — List purchasable ancillaries (paid bags / seats / meals) - Amadeus `Service_StandaloneCatalogue` — the chargeable services available for this booking, with the identifiers needed to purchase them. `service_group`: `BG` baggage · ` - path: booking_id*: string - query: service_group: string - `POST /api/v1/bookings/{booking_id}/ancillaries/emd` [user] — Issue EMD(s) for priced ancillaries - Amadeus `DocIssuance_IssueMiscellaneousDocuments` — issues the EMD for each TSM. Omit `tsm_references` to issue every TSM on the PNR (they are looked up with `Ticket_Retri - path: booking_id*: string - `POST /api/v1/bookings/{booking_id}/ancillaries/purchase` [user] — Book + price paid ancillaries (creates TSMs) - Books and prices the selected chargeable services on the PNR and creates a TSM for each — the step before EMD issuance. Amadeus flow: `ServiceBookPriceService` (one call p - path: booking_id*: string #### Baggage - `POST /api/v1/bookings/bags/catalogue` [user] — Bag catalogue for a flight offer (pricing?include=bags) - Step 1 of the AQC §4.3 Bags scenario: price a search offer and return its chargeable-baggage catalogue. Send the offer_id from search; the offer is resolved and priced server-side - body (RevalidationRequest): offer_id*: string; currency*: enum(GBP|USD|EUR|BDT|SAR|AED|BHD|QAR|KWD|OMR|PKR|INR|MYR|SGD|LKR); passengers: array - `POST /api/v1/bookings/bags/reprice` [user] — Re-price a flight offer with chosen bags - Step 2 of the AQC §4.3 Bags scenario: re-price the offer with the selected chargeable bags injected, so the new total reflects the charge. Send the offer_id plus selections [{trave - body (BagRepriceRequest): offer_id*: string; currency: string; passengers: array; selections: array - `GET /api/v1/bookings/{booking_id}/baggage` [user] — Get baggage allowances - Retrieve baggage allowances and ancillary information for a booking. - path: booking_id*: string #### Booking servicing - `GET /api/v1/bookings/{booking_id}/servicing` [user] — List post-ticketing requests - List the post-ticketing requests raised against this booking and their state (`Requested / InProcess / Completed / Deleted / Rejected / QuoteChanged`). Servicing is asynch - path: booking_id*: string #### Create & price - `POST /api/v1/bookings/createPnr` [user, idem] — Create PNR/Booking - Create a flight booking (PNR) with the airline. **Required Fields:** - `offer_id`: Flight offer ID to book - `currency`: Payment currency - `passengers`: List - query: Idempotency-Key*: string - body (CreateBookingRequest): offer_id*: string; currency*: enum(GBP|USD|EUR|BDT|SAR|AED|BHD|QAR|KWD|OMR|PKR|INR|MYR|SGD|LKR); passengers*: array; contact*: json; commission_percentage: number; payment_mode: string; client_ref: string; snapshot_id: string; search_id: string; additional_offer_ids: array; order_remarks: array; queue_placement: json - `POST /api/v1/bookings/fareRules` [user] — Get fare rules for an offer - Retrieve detailed fare rules and restrictions for a flight offer. **Required Fields:** - `offer_id`: The flight offer ID from search results - body (FareRulesByOfferRequest): offer_id*: string - `POST /api/v1/bookings/revalidation` [user] — Revalidate flight offer price - query: verbose: bool - body (RevalidationRequest): offer_id*: string; currency*: enum(GBP|USD|EUR|BDT|SAR|AED|BHD|QAR|KWD|OMR|PKR|INR|MYR|SGD|LKR); passengers: array - `POST /api/v1/bookings/upsell` [user] — Branded-fare upsell for a flight offer - Retrieve branded-fare alternatives (Basic / Standard / Flex, …) for a search offer via the GDS upselling endpoint (AQC certified §4.7 Branded Fares Upsell). Send the offer_id from - body (RevalidationRequest): offer_id*: string; currency*: enum(GBP|USD|EUR|BDT|SAR|AED|BHD|QAR|KWD|OMR|PKR|INR|MYR|SGD|LKR); passengers: array #### Flight bookings - `GET /api/v1/bookings/{booking_id}` [user] — Get booking details - Retrieve complete booking details by booking_id or PNR. **Accepts:** - booking_id (numeric ID) - PNR (6-character alphanumeric code) **Returns:** Complete - path: booking_id*: string - `POST /api/v1/bookings/{booking_id}/authorize` [user, idem] — Authorize payment for booking - Authorize payment for a created booking. **Required Fields:** - `token`: Payment token from PSP - `currency`: Payment currency - `amount_minor`: Amount in mi - path: booking_id*: string - query: Idempotency-Key*: string - body (PaymentAuthorizeRequest): token*: string; currency*: enum(GBP|USD|EUR|BDT|SAR|AED|BHD|QAR|KWD|OMR|PKR|INR|MYR|SGD|LKR); amount_minor*: number - `POST /api/v1/bookings/{booking_id}/cancel` [user] — Cancel booking - Cancel an existing booking/PNR. **Response Includes:** - Refund amount (if applicable) - Cancellation fees - Updated booking status - path: booking_id*: string - `PATCH /api/v1/bookings/{booking_id}/commission` [user] — Add FM (agency) commission to an order - Add a commission to the flight order via GDS PATCH (AQC certified FM Commission). Provide either amount or percentage. - path: booking_id*: string - body (CommissionRequest): amount: string; percentage: number; commission_type: string; vat: bool; traveler_ids: array; segment_ids: array - `PATCH /api/v1/bookings/{booking_id}/foid` [user] — Add Form of Identification (FOID) to an order - Add a FOID to the flight order via GDS PATCH (AQC certified). - path: booking_id*: string - body (FoidRequest): number*: string; identification_type: string; carrier_code: string; traveler_ids: array; flight_offer_ids: array - `POST /api/v1/bookings/{booking_id}/notes` [user] — Attach notes to the booking at the provider - Attach one or more notes to the booking **at the provider**. Servicing a consolidator booking happens partly by conversation — a waiver code, an agent's reference, why a n - path: booking_id*: string - body (BookingNotesRequest): notes*: array - `GET /api/v1/bookings/{booking_id}/order` [user] — Retrieve flight order by reference - Retrieve the live flight order from the GDS by its provider reference (AQC certified). - path: booking_id*: string - `GET /api/v1/bookings/{booking_id}/order/by-reference` [user] — Retrieve flight order by record locator (by-reference) - Retrieve the live flight order from the GDS by its PNR / record locator (AQC certified by-reference). - path: booking_id*: string - query: reference: string - `GET /api/v1/bookings/{booking_id}/rules` [user] — Get fare rules for booking - Retrieve fare rules and restrictions for an existing booking. - path: booking_id*: string #### Hotel operations - `POST /api/v1/hotel/book` [user, idem] — Create hotel booking - Book a hotel room. Requires a valid rate_key from search/check-rate. Rate is re-validated before confirmation (same as flight booking flow). **Idempotency:** Requires - query: Idempotency-Key*: string - body (HotelBookingRequest): rate_key*: string; provider*: string; guests*: array; contact_email*: string; contact_phone*: string; special_requests: string; client_ref: string - `GET /api/v1/hotel/bookings` [user] — List my hotel bookings - List all hotel bookings for the current user with pagination. - query: page: number; page_size: number - `GET /api/v1/hotel/bookings/{booking_id}` [user] — Get hotel booking details - Retrieve complete booking details by booking ID. - path: booking_id*: number - `POST /api/v1/hotel/bookings/{booking_id}/cancel` [user] — Cancel hotel booking - Cancel an existing hotel booking. Calls the provider cancellation API and updates DB status. **Response includes:** - Cancellation fee (if applicable) - Refund - path: booking_id*: number - `POST /api/v1/hotel/check-rate` [user] — Re-validate hotel rate - Check if a specific room rate is still available and at what price. Equivalent to flight price revalidation — MUST be called before booking. Uses raw_hotel_offers from - body (RateCheckRequest): rate_key*: string; provider*: string #### Payments - `POST /api/v1/bookings/{booking_id}/payment/capture` [user, idem] — Capture authorized payment - Capture (charge) an authorized payment. **State Requirement:** Payment must be in AUTHORIZED state. **Parameters:** - `amount_minor`: Amount to capture in min - path: booking_id*: string - query: amount_minor: number; Idempotency-Key*: string - `GET /api/v1/bookings/{booking_id}/payment/history` [user] — Get payment transaction history - Get complete payment transaction history for a booking. **Returns:** All payment transactions (authorizations, captures, voids, refunds). - path: booking_id*: string - `POST /api/v1/bookings/{booking_id}/payment/refund` [user, idem] — Refund captured payment - Refund a captured payment (full or partial). **State Requirement:** Payment must be in CAPTURED or SETTLED state. **Use Case:** Customer cancellation, service iss - path: booking_id*: string - query: amount_minor: number; reason: string; Idempotency-Key*: string - `POST /api/v1/bookings/{booking_id}/payment/void` [user, idem] — Void (cancel) authorized payment - Void an authorized payment (release held funds). **State Requirement:** Payment must be in AUTHORIZED state (not yet captured). **Use Case:** Cancel booking befor - path: booking_id*: string - query: reason: string; Idempotency-Key*: string #### Seats - `GET /api/v1/bookings/{booking_id}/seats` [user] — Get seat map for booking - Retrieve available seats and seating map for a booking. - path: booking_id*: string - `POST /api/v1/bookings/{booking_id}/seats` [user] — Select seat for passenger - Select a specific seat for a passenger. **Query Parameters:** - `segment_id`: Flight segment identifier - `seat_number`: Seat number to select - `passenger_i - path: booking_id*: string - query: segment_id*: string; seat_number*: string; passenger_id*: string - `POST /api/v1/bookings/{booking_id}/seats/batch` [user] — Reserve several seats in one GDS session - Reserve every seat for a booking in a **single** Amadeus session. `POST /{booking_id}/seats` opens a full stateful conversation per seat (PNR_Retrieve → PNR_AddMultiElemen - path: booking_id*: string - `POST /api/v1/bookings/{booking_id}/seats/issue` [user] — Pay for the seats held on a booking (price + EMD) - Turn the seats already held on the PNR into **paid** seats. A seat request only asks the airline for a seat. When the seat is chargeable the airline expects payment, which - path: booking_id*: string - query: issue_emd_documents: bool #### Ticketing - `POST /api/v1/bookings/{booking_id}/ticket` [user, idem] — Issue e-tickets - Issue electronic tickets for a confirmed booking. **Parameters:** - `capture`: Whether to capture authorized payment (default: true) **Idempotency:** - Re - path: booking_id*: string - query: Idempotency-Key*: string - body (TicketRequest): capture: bool - `GET /api/v1/bookings/{booking_id}/ticket/document` [user] — Get the e-ticket document (coupons) - Retrieve the e-ticket document: one **coupon per flight**, each with its own status (OPEN / USED / EXCHANGED / REFUNDED / VOID), plus the issuing IATA number, fare calculat - path: booking_id*: string - `GET /api/v1/bookings/{booking_id}/ticket/status` [user] — Live ticket-order status - Read the provider's current ticket-order state. Issuance is not always synchronous. A consolidator GDS fare returns success from ticketing as soon as the order is **placed - path: booking_id*: string - `POST /api/v1/bookings/{booking_id}/ticket/{action}` [user] — Void, refund, or price a reissue on an issued ticket (quote-first) - Raise a **post-ticketing request** against an issued ticket. `action` is `void`, `refund`, or `reissue`. **`reissue` is quote-only.** It prices what changing the ticket wo - path: booking_id*: string; action*: string - query: confirm: bool; note: string #### Transport operations - `POST /api/v1/transport/book` [user, idem] — Book a ground transfer - Book a ground transfer. Requires a valid quote_id from search results. **Idempotency:** Requires Idempotency-Key header to prevent double bookings. - query: Idempotency-Key*: string - body (TransportBookingRequest): quote_id*: string; provider*: string; passengers*: array; contact*: json; flight_number: string; hotel_name: string; special_requests: string - `GET /api/v1/transport/bookings` [user] — List my transport bookings - List all transport bookings for the current user with pagination. - query: page: number; page_size: number - `GET /api/v1/transport/bookings/{booking_id}` [user] — Get transport booking details - Get transport booking by ID. - path: booking_id*: number - `POST /api/v1/transport/bookings/{booking_id}/cancel` [user] — Cancel transport booking - Cancel an existing transport booking. Calls the provider cancellation API and updates DB status. - path: booking_id*: number - `POST /api/v1/transport/quote` [user] — Re-validate transport quote - Check if a specific transfer quote is still available and at what price. - body (QuoteDetailRequest): quote_id*: string; provider*: string ### Admin (46) #### Companies - `GET /api/v1/admin/companies` [role, tenant] — List all companies - Paginated list of all companies with filtering. - query: page: number; page_size: number; status: string; company_type: string; search: string; sort_by: string; sort_order: string - `POST /api/v1/admin/companies` [role, tenant] — Create a new company - Register a new B2B agent company on the platform. - body (CreateCompanyRequest): company_name*: string; company_code*: string; company_type: enum(travel_agency|corporate|consolidator|sub_agent|ota); contact_email*: string; contact_phone: string; currency: string; credit_limit: number; address: json; parent_company_id: number; settings: json - `DELETE /api/v1/admin/companies/{company_id}` [role, tenant] — Soft-delete company - path: company_id*: number - `GET /api/v1/admin/companies/{company_id}` [role] — Get company details - path: company_id*: number - `PATCH /api/v1/admin/companies/{company_id}` [role, tenant] — Update company details - path: company_id*: number - body (UpdateCompanyRequest): company_name: string; contact_email: string; contact_phone: string; currency: string; credit_limit: number; address: json; settings: json - `POST /api/v1/admin/companies/{company_id}/activate` [role, tenant] — Re-activate a suspended company - path: company_id*: number - `POST /api/v1/admin/companies/{company_id}/suspend` [role, tenant] — Suspend a company - Block all operations for this company. Existing bookings remain. - path: company_id*: number - body (CompanyStatusChange): reason: string #### Flight bookings - `GET /api/v1/admin/bookings` [role, tenant] — List all bookings - Global booking list with filtering by status, company, supplier, date range. - query: page: number; page_size: number; status: string; company_id: number; user_id: string; supplier: string; pnr: string; date_from: string; date_to: string; search: string; sort_by: string; sort_order: string - `GET /api/v1/admin/bookings/reconciliation` [role] — View reconciliation queue - `GET /api/v1/admin/bookings/{booking_id}` [role] — Get booking details - Full booking with passengers, payment, tickets, and audit trail. - path: booking_id*: number - `POST /api/v1/admin/bookings/{booking_id}/override-status` [role, tenant] — Override booking status - Admin force-change booking status. Requires reason. Fully audited. - path: booking_id*: number - body (OverrideBookingStatusRequest): new_status*: enum(initiated|pending_pnr|pnr_failed|on_hold|confirmed|payment_pending|payment_failed|paid|ticketed|cancelled|refunded|expired); reason*: string; notify_customer: bool - `POST /api/v1/admin/bookings/{booking_id}/reconcile` [role, tenant] — Trigger manual reconciliation - Add booking to reconciliation queue for provider verification. - path: booking_id*: number - body (TriggerReconciliationRequest): force: bool #### GDS operations - `GET /api/v1/admin/gds/circuit-breakers` [role] — Circuit breaker states - `GET /api/v1/admin/gds/performance` [role] — GDS performance metrics - query: provider: string; period: string - `GET /api/v1/admin/gds/status` [role] — GDS provider health overview - Status of all GDS connections including circuit breaker state. - `PATCH /api/v1/admin/gds/{provider}/config` [role] — Update GDS configuration - path: provider*: string - body (UpdateGDSConfigRequest): enabled: bool; timeout: number; max_results: number; priority: number - `POST /api/v1/admin/gds/{provider}/reset-circuit` [role] — Reset circuit breaker - Force-close a provider's circuit breaker. - path: provider*: string #### Hotel bookings - `GET /api/v1/admin/hotel-bookings` [role, tenant] — List all hotel bookings - Global hotel booking list with filtering by status, company, provider, date range. - query: page: number; page_size: number; status: string; company_id: number; user_id: string; provider: string; date_from: string; date_to: string; search: string; sort_by: string; sort_order: string - `GET /api/v1/admin/hotel-bookings/stats/summary` [role] — Hotel bookings statistics - Summary counts by status for admin dashboard widgets. - `GET /api/v1/admin/hotel-bookings/{booking_id}` [role] — Get hotel booking details - Full hotel booking with guest info and audit trail. - path: booking_id*: number - `POST /api/v1/admin/hotel-bookings/{booking_id}/override-status` [role, tenant] — Override hotel booking status - Admin force-change hotel booking status. Fully audited. - path: booking_id*: number - query: new_status*: string; reason*: string #### Markup rules - `GET /api/v1/admin/markup-rules` [role] — List markup rules - List all platform markup rules with optional company filter. - query: company_id: number; is_active: bool; page: number; page_size: number - `POST /api/v1/admin/markup-rules` [role] — Create markup rule - Create a new markup rule. Set company_id=null for platform-wide rules. - body (CreateMarkupRuleRequest): company_id: number; rule_type*: enum(fixed|percentage|per_pax|per_segment); amount*: number; currency: string; origin: string; destination: string; cabin_class: enum(economy|premium_economy|business|first); airline: string; gds_provider: string; min_fare: number; max_fare: number; priority: number; is_active: bool; description: string - `POST /api/v1/admin/markup-rules/calculate` [role] — Calculate markup for a price - Preview what markup rules would apply to a given price/route combination. - query: base_price*: number; company_id: number; origin: string; destination: string; cabin_class: string; airline: string - `DELETE /api/v1/admin/markup-rules/{rule_id}` [role] — Delete markup rule (soft) - path: rule_id*: number - `PATCH /api/v1/admin/markup-rules/{rule_id}` [role] — Update markup rule - path: rule_id*: number - body (UpdateMarkupRuleRequest): amount: number; currency: string; origin: string; destination: string; cabin_class: enum(economy|premium_economy|business|first); airline: string; priority: number; is_active: bool; description: string #### Payments - `GET /api/v1/admin/payments` [role] — List all payments - Global payment list with filtering by state, provider, company. - query: page: number; page_size: number; payment_state: string; provider_name: string; company_id: number; date_from: string; date_to: string; sort_by: string; sort_order: string - `GET /api/v1/admin/payments/settlement-report` [role] — Settlement report - Aggregated settlement data for a period. - query: period: string - `POST /api/v1/admin/payments/{payment_id}/manual-refund` [role, tenant] — Process manual refund - Admin-initiated refund with reason. Audit logged. - path: payment_id*: number - body (ManualRefundRequest): amount_minor*: number; currency*: string; reason*: string; notify_customer: bool #### Reports - `GET /api/v1/admin/reports/audit` [role] — Audit log - Full audit trail with filtering by event type, user, date range. - query: page: number; page_size: number; event: string; user_id: string; date_from: string; date_to: string - `GET /api/v1/admin/reports/dashboard` [role] — Platform dashboard KPIs - High-level stats: bookings, revenue, users, system health. - `GET /api/v1/admin/reports/live` [role] — Live system status - Real-time: active searches, connections, component health. - `GET /api/v1/admin/reports/revenue` [role] — Revenue report - Platform revenue breakdown by company, provider, period. - query: period: string; company_id: number #### System - `GET /api/v1/admin/system/cache-stats` [role] — Cache statistics - Redis cache hit/miss ratios and key distribution. - `POST /api/v1/admin/system/clear-cache` [role] — Invalidate cache keys - Clear specific cache key patterns. Use with caution. - query: pattern*: string - `GET /api/v1/admin/system/error-logs` [role] — System error logs - Recent error logs from all stages (search, booking, payment, ticketing). - query: page: number; page_size: number; stage: string; provider: string - `GET /api/v1/admin/system/health` [role] — System component health - Detailed health check of all system components (Redis, MongoDB, Supabase, Celery). #### Transport bookings - `GET /api/v1/admin/transport-bookings` [role, tenant] — List all transport bookings - Global transport booking list with filtering by status, company, provider, date range. - query: page: number; page_size: number; status: string; company_id: number; user_id: string; provider: string; date_from: string; date_to: string; search: string; sort_by: string; sort_order: string - `GET /api/v1/admin/transport-bookings/stats/summary` [role] — Transport bookings statistics - Summary counts by status for admin dashboard widgets. - `GET /api/v1/admin/transport-bookings/{booking_id}` [role] — Get transport booking details - Full transport booking with passenger info and audit trail. - path: booking_id*: number - `POST /api/v1/admin/transport-bookings/{booking_id}/override-status` [role, tenant] — Override transport booking status - Admin force-change transport booking status. Fully audited. - path: booking_id*: number - query: new_status*: string; reason*: string #### Users - `GET /api/v1/admin/users` [role] — List all users - Paginated list of all platform users with filtering by role, company, status. - query: page: number; page_size: number; status: string; role: string; company_id: number; search: string; is_active: bool; sort_by: string; sort_order: string - `GET /api/v1/admin/users/{user_id}` [role] — Get user details - path: user_id*: string - `PATCH /api/v1/admin/users/{user_id}` [role, tenant] — Admin update user - Override user role, status, company assignment. - path: user_id*: string - body (AdminUpdateUserRequest): full_name: string; role: enum(super_admin|company_admin|company_staff|customer); status: enum(active|pending|suspended|inactive); company_id: number; is_active: bool; phone: string; department: string - `POST /api/v1/admin/users/{user_id}/impersonate` [role, tenant] — Impersonate user - Generate impersonation session for debugging. FULLY AUDITED. - path: user_id*: string - body (ImpersonateRequest): reason*: string - `POST /api/v1/admin/users/{user_id}/suspend` [role, tenant] — Suspend user - Suspend a user account with reason. Blocks all operations. - path: user_id*: string - body (SuspendUserRequest): reason*: string; duration_hours: number ### Company (33) #### Clients - `GET /api/v1/company/clients` [role, tenant] — List company clients - query: page: number; page_size: number; search: string; client_type: string - `POST /api/v1/company/clients` [role, tenant] — Create client - body (CreateClientRequest): email*: string; full_name*: string; client_type: enum(traveler|sub_agent|corporate); phone: string; company_name: string; credit_limit: number; notes: string - `GET /api/v1/company/clients/{client_id}` [role, tenant] — Get client details - path: client_id*: number - `PATCH /api/v1/company/clients/{client_id}` [role, tenant] — Update client - path: client_id*: number - body (UpdateClientRequest): full_name: string; phone: string; credit_limit: number; notes: string; is_active: bool - `GET /api/v1/company/clients/{client_id}/bookings` [role, tenant] — Get client's bookings - path: client_id*: number #### Flight bookings - `GET /api/v1/company/bookings` [role, tenant] — List company bookings - Bookings scoped to your company only. - query: page: number; page_size: number; status: string; search: string; date_from: string; date_to: string; sort_by: string; sort_order: string - `GET /api/v1/company/bookings/pending` [role, tenant] — Bookings requiring action - Payment pending, ticketing pending, and on-hold expiring bookings. - `GET /api/v1/company/bookings/{booking_id}` [role, tenant] — Get booking detail - path: booking_id*: number - `POST /api/v1/company/bookings/{booking_id}/assign` [role, tenant] — Assign booking to staff - path: booking_id*: number - body (AssignBookingRequest): staff_user_id*: string; notes: string #### Hotel bookings - `GET /api/v1/company/hotel-bookings` [role, tenant] — List company hotel bookings - Hotel bookings scoped to your company only. - query: page: number; page_size: number; status: string; search: string; date_from: string; date_to: string; sort_by: string; sort_order: string - `GET /api/v1/company/hotel-bookings/pending` [role, tenant] — Hotel bookings requiring action - Pending confirmation and on-request hotel bookings for the company. - `GET /api/v1/company/hotel-bookings/{booking_id}` [role, tenant] — Get hotel booking detail - path: booking_id*: number #### Markup rules - `GET /api/v1/company/markup-rules` [role, tenant] — List company markup rules - query: page: number; page_size: number - `POST /api/v1/company/markup-rules` [role, tenant] — Create company markup rule - Add markup that will be applied to your clients' prices. - body (CreateMarkupRuleRequest): company_id: number; rule_type*: enum(fixed|percentage|per_pax|per_segment); amount*: number; currency: string; origin: string; destination: string; cabin_class: enum(economy|premium_economy|business|first); airline: string; gds_provider: string; min_fare: number; max_fare: number; priority: number; is_active: bool; description: string - `DELETE /api/v1/company/markup-rules/{rule_id}` [role, tenant] — Delete company markup rule - path: rule_id*: number - `PATCH /api/v1/company/markup-rules/{rule_id}` [role, tenant] — Update company markup rule - path: rule_id*: number - body (UpdateMarkupRuleRequest): amount: number; currency: string; origin: string; destination: string; cabin_class: enum(economy|premium_economy|business|first); airline: string; priority: number; is_active: bool; description: string #### Profile & settings - `GET /api/v1/company/profile` [role, tenant] — Get company profile - Get your company's profile details. - `PATCH /api/v1/company/profile` [role, tenant] — Update company profile - body (UpdateCompanyProfileRequest): company_name: string; contact_email: string; contact_phone: string; logo_url: string; website: string; address: json; business_registration: string; iata_number: string - `GET /api/v1/company/profile/settings` [role, tenant] — Get company settings - `PATCH /api/v1/company/profile/settings` [role, tenant] — Update company settings - body (UpdateCompanySettingsRequest): default_currency: string; auto_ticket: bool; notification_email: string; booking_confirmation_cc: string; default_markup_type: string; default_markup_amount: number; allow_on_hold: bool; max_hold_hours: number #### Reports - `GET /api/v1/company/reports/dashboard` [role, tenant] — Company dashboard KPIs - `GET /api/v1/company/reports/sales` [role, tenant] — Sales report - query: period: string - `GET /api/v1/company/reports/top-clients` [role, tenant] — Top clients by revenue - query: period: string; limit: number - `GET /api/v1/company/reports/top-routes` [role, tenant] — Top routes by bookings - query: period: string; limit: number #### Staff - `GET /api/v1/company/staff` [role, tenant] — List company staff - query: page: number; page_size: number - `POST /api/v1/company/staff/invite` [role, tenant] — Invite new staff member - Generate invitation for a new staff member. They'll receive an email with join link. - body (InviteStaffRequest): email*: string; full_name*: string; role: enum(company_admin|company_staff); department: string; phone: string; permissions: array - `PATCH /api/v1/company/staff/{staff_id}` [role, tenant] — Update staff member - path: staff_id*: number - body (UpdateStaffRequest): role: enum(company_admin|company_staff); department: string; phone: string; permissions: array; is_active: bool - `POST /api/v1/company/staff/{staff_id}/deactivate` [role, tenant] — Deactivate staff member - path: staff_id*: number #### Transport bookings - `GET /api/v1/company/transport-bookings` [role, tenant] — List company transport bookings - Transport bookings scoped to your company only. - query: page: number; page_size: number; status: string; search: string; date_from: string; date_to: string; sort_by: string; sort_order: string - `GET /api/v1/company/transport-bookings/pending` [role, tenant] — Transport bookings requiring action - Pending confirmation and on-hold transport bookings for the company. - `GET /api/v1/company/transport-bookings/{booking_id}` [role, tenant] — Get transport booking detail - path: booking_id*: number #### Wallet - `GET /api/v1/company/wallet` [role, tenant] — Get wallet balance - Current balance, credit limit, and available credit. - `GET /api/v1/company/wallet/transactions` [role, tenant] — Transaction ledger - Credit/debit transaction history. - query: page: number; page_size: number; transaction_type: string ### Customer (19) #### Flight bookings - `GET /api/v1/customer/bookings` [role, tenant] — My bookings - List of your bookings with pagination. - query: page: number; page_size: number; status: string - `GET /api/v1/customer/bookings/{booking_id}` [role, tenant] — Booking detail - path: booking_id*: number - `POST /api/v1/customer/bookings/{booking_id}/cancel` [role, tenant] — Request cancellation - path: booking_id*: number - body (CancelBookingRequest): reason: string #### Hotel bookings - `GET /api/v1/customer/hotel-bookings` [role, tenant] — My hotel bookings - List your hotel bookings with pagination and status filter. - query: page: number; page_size: number; status: string - `GET /api/v1/customer/hotel-bookings/{booking_id}` [role, tenant] — Hotel booking detail - path: booking_id*: number - `POST /api/v1/customer/hotel-bookings/{booking_id}/cancel` [role, tenant] — Cancel hotel booking - path: booking_id*: number #### Payments - `GET /api/v1/customer/payments` [role, tenant] — My payment history - query: page: number; page_size: number - `GET /api/v1/customer/payments/receipts/{payment_id}` [role, tenant] — Get payment receipt - path: payment_id*: number #### Profile - `GET /api/v1/customer/profile` [role, tenant] — Get my profile - `PATCH /api/v1/customer/profile` [role, tenant] — Update my profile - body (UpdateProfileRequest): full_name: string; phone: string; date_of_birth: string; nationality: string; preferred_language: string; preferred_currency: string - `GET /api/v1/customer/profile/preferences` [role, tenant] — Get my preferences - `PATCH /api/v1/customer/profile/preferences` [role, tenant] — Update my preferences - body (UpdatePreferencesRequest): seat_preference: string; meal_preference: string; cabin_preference: string; preferred_airlines: array; notification_email: bool; notification_sms: bool #### Transport bookings - `GET /api/v1/customer/transport-bookings` [role, tenant] — My transport bookings - List your transport bookings with pagination and status filter. - query: page: number; page_size: number; status: string - `GET /api/v1/customer/transport-bookings/{booking_id}` [role, tenant] — Transport booking detail - path: booking_id*: number - `POST /api/v1/customer/transport-bookings/{booking_id}/cancel` [role, tenant] — Cancel transport booking - path: booking_id*: number #### Travelers - `GET /api/v1/customer/travelers` [role, tenant] — List saved travelers - `POST /api/v1/customer/travelers` [role, tenant] — Save a new traveler - body (CreateTravelerRequest): first_name*: string; last_name*: string; date_of_birth*: string; gender*: enum(M|F|O); nationality: string; email: string; phone: string; doc_type: enum(passport|id_card|visa); doc_number: string; doc_expiry: string; doc_issuing_country: string; is_primary: bool; nickname: string - `DELETE /api/v1/customer/travelers/{traveler_id}` [role, tenant] — Delete saved traveler - path: traveler_id*: number - `PATCH /api/v1/customer/travelers/{traveler_id}` [role, tenant] — Update saved traveler - path: traveler_id*: number - body (UpdateTravelerRequest): first_name: string; last_name: string; date_of_birth: string; gender: enum(M|F|O); nationality: string; email: string; phone: string; doc_type: enum(passport|id_card|visa); doc_number: string; doc_expiry: string; doc_issuing_country: string; nickname: string ### Platform (15) #### Authentication - `POST /api/v1/auth/login` [none] — Login User - Authenticates a user using Supabase credentials - body (LoginRequest): email*: string; password*: string - `GET /api/v1/auth/me` [user] — Get current user profile - Returns the authenticated user's profile from JWT token. - `POST /api/v1/auth/register` [none] — Register User - Register user with real email verification - body (UserRegistrationRequest): email*: string; password*: string; full_name*: string; role: string; company_code: string; user_code: string; department: string; phone: string; registration_type: string; invite_code: string - `GET /api/v1/auth/verify-email` [none] — Verify Email - Handle email verification callback from Supabase (API-only JSON response) - query: access_token: string; refresh_token: string; expires_at: number; token_type: string; type: string #### Cache & metrics - `GET /metrics/cache` [none] — Cache Metrics - Get cache service metrics - WARNING: No authentication required on this route — anyone who can reach the API can call it. - `GET /metrics/combined` [none] — Combined Metrics - Get combined system metrics - WARNING: No authentication required on this route — anyone who can reach the API can call it. - `GET /metrics/redis` [none] — Redis Metrics - Get Redis performance metrics - WARNING: No authentication required on this route — anyone who can reach the API can call it. #### Configuration - `GET /config` [none] — Get Configuration - Get current application configuration — safe public values only - WARNING: No authentication required on this route — anyone who can reach the API can call it. #### Health - `GET /api/v1/health/` [none] — Health probe (router root alias) - Alias of the health endpoint; the router is mounted twice, so four health paths exist. - `GET /api/v1/health/health` [none] — System Health Check - Aggregated health check for Redis and MongoDB. Returns service availability status. - `GET /health/` [none] — Health probe (router root alias) - Alias of the health endpoint; the router is mounted twice, so four health paths exist. - `GET /health/health` [none] — System Health Check - Aggregated health check for Redis and MongoDB. Returns service availability status. #### Maintenance - `POST /admin/cache/clear` [none] — Clear Cache - Clear all cache data (development only) - query: confirm: bool - WARNING: No authentication required on this route — anyone who can reach the API can call it. - `POST /admin/maintenance/run` [none] — Run Maintenance - Manually trigger cache maintenance (development only) - WARNING: No authentication required on this route — anyone who can reach the API can call it. #### Service info - `GET /` [none] — Root - Root endpoint with API information - WARNING: No authentication required on this route — anyone who can reach the API can call it. --- (c) Sitenet Tech. Generated from the TSE OpenAPI schema.