Getting started
Permissions
Each key reads only what its owner allowed when creating it. A call to an endpoint the key cannot read returns 403 with the code insufficient_scope.
trips:read
Trips, itineraries and options, as the client sees them on their trip page, with the package price. Never internal costs, margins, transfer operators, booking references or internal notes, and never a price per item.
contacts:read
Your contacts and each trip's travellers. This is personal data: names, emails, phones and addresses. Never your notes about them.
payments:read
The payments you have shown your clients: amounts, what is paid and due, and the link where the client pays.
An owner chooses the permissions when creating the key, in Settings → API. To change them, create a new key and revoke the old one.
GET /key lists what a key can read.