Vacabee Partner API
Put travel inside your own product.
Hotels, flights, transfers and eSIM — searched and booked from your app, on your prices, under your brand. One key, one versioned API, a typed SDK. Start in the sandbox, go live with the same endpoints.
- operations in /v1
- 50
- operations in /v1
- bookable verticals
- 4
- bookable verticals
- API key to go live
- 1
- API key to go live
- supplier calls from the sandbox
- 0
- supplier calls from the sandbox
import { VacabeeClient } from '@vacabeedev/partner-api';const vacabee = new VacabeeClient({ apiKey: process.env.VACABEE_API_KEY! }); The inventory
Everything a trip is made of, behind one surface.
Hotels
Resolve a destination, open a search session, read live rates, book and cancel. One indicative price per hotel, a real availability check before the booking.
API referenceFlights
Synchronous search — the response carries the offers. Re-price a single offer, book, change and cancel, with airline conditions passed through verbatim.
API referenceTransfers
Live availability for a route in one call: vehicle, category and journey time per offer. Book against a quote, get a cancellation quote before you cancel.
API referenceeSIM
The plan catalogue at your net purchase prices — free to read. Order a plan and hand the traveller a QR code; usage stays queryable per order.
API referenceTypeScript SDK
The boring parts, already done.
Everything the documentation asks you to get right — the right host for your key, an idempotency key that survives a retry, the quota headers, the constant-time signature check — the SDK already does. Thin on purpose: typed calls over fetch, no runtime dependencies, the same /v1 underneath.
- The host is not something you configure
- The client reads your key's prefix — vcb_test_ goes to the sandbox, vcb_live_ to production. A stale URL in your config cannot point a test key at real money, because there is no URL in your config.
- Idempotency you cannot forget
- Booking methods derive the Idempotency-Key from your own order number, so a retry — or a second process — cannot turn one order into two bookings.
- Webhooks verified in one line
- webhookHandler checks the signature in constant time, drops replays, routes by event type and deduplicates — with adapters for Express, fetch runtimes and bare Node.
- Typed from the same contract
- Request and response types are generated from the same OpenAPI document as the reference, and CI compares both byte for byte. A field that changes shape breaks your build, not your booking.
The SDK page has the full tour — including an honest word on where the package stands on the registry today.
import { webhookHandler, memoryDeduplicator }
from '@vacabeedev/partner-api';
const hook = webhookHandler({
secret: process.env.VACABEE_WEBHOOK_SECRET!,
seen: memoryDeduplicator(),
on: {
'booking.confirmed': async (event) => queue.add(event),
},
});
app.post('/hooks/vacabee',
express.raw({ type: 'application/json' }), hook.express);Developer experience
Built the way you would have built it.
Idempotent writes, enforced
Every POST requires an Idempotency-Key. The same key replays the stored answer; the same key with a different body is rejected. This is enforced, not advisory.
Signed webhooks
HMAC-SHA256 over the raw body with a five-minute tolerance and a rotatable secret — plus a delivery log that shows every attempt and lets you retry.
A sandbox that tells the truth
Same endpoints, same payloads, zero supplier traffic — and six forced failures, so you can test the error paths you hope never run.
Quota you can see coming
X-Search-Quota-* headers ride on every response, and X-Search-Billable says whether a call consumed a search. Sum them and you have our invoice.
Versioned, with manners
Additive changes land in /v1 without notice; breaking changes only ever appear as /v2. Deprecation and Sunset headers warn you before anything retires.
Your prices, not ours
Net rates in, your own markup on top. Per-request usage, commissions and monthly statements are all visible in the partner portal.
How it works
Sandbox first, live when you are.
Create a sandbox key
Sign in, generate a scoped test key and call GET /v1/ping. Sandbox traffic never reaches a supplier and never costs you anything.
Build and test
Search, book and cancel against sandbox endpoints that behave like production — webhooks, idempotency and quota headers included, typed end to end if you use the SDK.
Go live
Switch to a live key. The SDK picks the host from the key itself — same endpoints, same payloads, nothing to rewrite.
Ready to build?
The sandbox is free, seeded and one API key away. Bring your stack — we bring the travel.