Sign in

API reference

Every operation, as the gateway describes it

50 operations in 8 areas, generated from the OpenAPI document of version 1.0 of the API. Scope, rate-limit class, search-quota cost and idempotency rule come off the routes themselves, so a page here cannot describe a permission the gateway does not enforce.

By area

Meta2 operationsReachability, account, permissions and limitsAccount3 operationsYour prepaid balance, every movement on it, and the free search allowance left for today.Hotels10 operationsResolve a destination, search, read the rates of one hotel, book. Searching is billable; a booking is charged to your account.Flights9 operationsSearch, re-price the offer you picked, book it. Both search and re-pricing are billable; a booking is charged to your account.Transfers6 operationsAirport and point-to-point rides: availability for a route, booking, what a cancellation would cost, and the cancellation itself.eSIM8 operationsCoverage by country and region, plans at your net price, and orders with their activation data and live usage.Webhooks9 operationsDelivery targets and the history. Needs its own scope webhooks:manage — whoever can change targets can redirect the event stream.Health3 operationsOperational. Not part of the partner contract.

What every operation shares

Errors26 typesThe error envelope, every value error.type can take, the status that carries it and whether a retry can succeed.SchemasEvery object in the contract with its fields, types and required flags. Operation pages link in here rather than repeating a type.Keys and scopesHow a key is presented, which scopes exist, and what a 403 tells you about the one that was missing.IdempotencyWhy every POST carries an Idempotency-Key, and what a replay returns.

Base URLs

EnvironmentBase URL
Livehttps://api.vacabee.com
Sandbox — no suppliers, no costshttps://sandbox-api.vacabee.com

Your API key from the partner portal: Authorization: Bearer vcb_live_... — or vcb_test_... against the sandbox. The gateway checks the key kind against the kind each deployment is configured to accept and refuses a mismatch with wrong_environment — but today a single deployment accepts both kinds, so that refusal does not fire yet. It starts to refuse once the two hosts are separate deployments; until then, match the key prefix against the base URL in your own configuration.

Every path on an operation page is relative to one of these two hosts. Nothing else changes between them: the same operations, the same schemas, the same errors.

How to read a page

BlockWhat it answers
GET/v1/…The call itself. The path is templated exactly as the gateway routes it.
Scope, rate limit, search quota, idempotencyWhat the key must carry, which limit bucket applies, whether the call consumes the daily search allowance, and whether an Idempotency-Key is mandatory.
ParametersEvery path, query and header parameter with its type, whether it is required, and the example the contract carries for it.
Request bodyThe schema the body has to match, linked into the schema catalogue where its fields, types and required flags are listed once.
ResponsesThe success shapes, linked into the schema catalogue rather than repeated.
ErrorsThe status codes this operation answers with, pointing at the shared error index.