Errors

Common validation and authentication errors returned by the API.

Common validation response

{
  "message": ["field must be a string"],
  "error": "Bad Request",
  "statusCode": 400
}

Normalized public errors

Provider and orchestration failures are normalized before they are returned to public API consumers. Public error bodies only expose a Travelandz code, a safe message and the internal request id.

{
  "code": "flight_offer_not_found",
  "message": "The requested flight offer is no longer available.",
  "request_id": "tzreq_123e4567-e89b-12d3-a456-426614174000"
}

When available, the same id is also returned in the response header:

X-Travelandz-Request-Id: tzreq_123e4567-e89b-12d3-a456-426614174000

Share this request_id with Travelandz support when reporting an incident. It is a Travelandz tracking id, not a database id and not an external provider request id.

Public error responses never include provider names, provider request ids, sensitive headers, tokens, HTTP client config, raw provider payloads, Mongo _id values, stack traces, internal service paths, provider cost fields or any other internal-only pricing data.

Provider error handling

Known external-source errors can be mapped to Travelandz-owned public codes and messages. For example, an expired or unavailable flight offer can return flight_offer_not_found with a message that tells the integrator what happened without exposing the upstream source.

If no active mapping exists for a known external-source error, the API still sanitizes the response and falls back to a safe Travelandz error shape with code, message and request_id.

Structured auth errors