Willkommen bei der Travelandz API

Basis und Authentifizierung

Richten Sie Basis-URLs, Pflicht-Header und API-Key-Authentifizierung für Travelandz-Integrationen ein.

Richten Sie Basis-URLs, Pflicht-Header und API-Key-Authentifizierung für Travelandz-Integrationen ein.

Required headers

HeaderValue
AuthorizationBearer <secret_key>
X-Travelandz-Id<public_key>:<profile_code>
Content-Typeapplication/json for requests with JSON body

Authentication flow

  1. The API token strategy reads Authorization and X-Travelandz-Id.
  2. The bearer token must match the encrypted secret stored for the selected credential.
  3. X-Travelandz-Id must include the public key and a valid Developer Profile code (profileCode, formatted as dp_<12 alphanumeric>). The legacy Mongo ObjectId format is no longer accepted.
  4. Sandbox uses testCredentials; production uses liveCredentials.
  5. The profile and company must be active.
  6. Production requires isProductionAllowed=true.
  7. If domainsAllowed is configured, the request IP, Origin hostname or Referer hostname must match.
  8. The used credential receives lastUsed and the request context stores profileId, profileCode, profileKey, credentialId and companyId.

Credential fields

FieldDescription
profileCodeDeveloper Profile code sent in X-Travelandz-Id, for example dp_a1b2c3d4e5f6. Find it in your dashboard.
credentialIdEmbedded credential _id, used for request log auditability.
publicKeyPublic identifier sent in X-Travelandz-Id, for example pk_sandbox_abc123.
secretKeySecret bearer token. Never store it client-side and never log it.
secretKeyLast4Last four visible characters for user identification.
domainsAllowedOptional IP or hostname allow-list.
lastUsedLast successful usage timestamp.