Partner API v1

Get access

Keys and sandbox

Send your key in the x-api-key header on every request. Each key is enabled for some products; a key without access gets 403 SCOPE_NOT_ALLOWED, and a key locked to IPs gets 403 IP_NOT_ALLOWED from any other address.

curl 'https://b2b.ideaholiday.com/api/v1/partner/wallet' \
  --header 'x-api-key: ih_test_<YOUR_KEY>'

Responses and booking safety

Every response uses one envelope. On an error status is "error" and errors holds { code, message }. Quote request_id (also the X-Request-Id header) to support.

{
  "request_id": "6f1c…",
  "status": "ok",
  "data": { },
  "errors": [],
  "meta": { "currency": "INR" }
}

Every booking needs a unique Idempotency-Key header: sending it again returns the first answer and never books twice. After a timeout, read the booking status before trying again. If the price changed since the quote, re-quote and confirm the new price.

Endpoints

Paths are relative to the base URL. Request and response shapes are in the OpenAPI file.

Loading endpoints…

Webhooks

Set one https URL under Help > API Access > Webhook and choose your events. We POST an event when a booking you made through the API changes later, and when your wallet runs low.

{
  "id": "delivery id",
  "event": "booking.pnr_changed",
  "sandbox": false,
  "createdAt": "2026-10-02T10:15:00.000Z",
  "data": { "product": "FD", "previousPnr": "OLD123", "booking": { "booking_id": "…", "pnr": "NEW456" } }
}

Headers: X-IH-Event, X-IH-Delivery (drop duplicates by it) and X-IH-Signature: t=<unix seconds>,v1=<hex>. Check it with HMAC-SHA256 of <t>.<raw body> using your signing secret and reject events older than 5 minutes. Answer with any 2xx; failures are retried after 1, 5, 30, 120 and 720 minutes.

Errors