DEVELOPER DOCSREST v1 • OpenAPI 3.1

Partner API

Flights, hotels, eSIM and transfers: the same keys and conventions, paid from your FlightOTA deposit.

X-Api-Key & X-Api-SecretBDT minor unitsIdempotency-Key

Getting started

Environment	Base URL	Key prefix
Sandbox	`https://sandbox.flightota.com/api/v1`	`ak_test_`
Production	`https://api.flightota.com/api/v1`	`ak_live_`

Get a key in the agent portal under API access, enabled for the product. The secret is shown once.
Whitelist your server's public IP on the key. Never call the API from a browser or app.
Send the two headers on every request. No login call, no token.
Call GET /ping first. It returns your agency code and the IP we saw.

Headers

X-Api-Key: ak_test_your_key_id
X-Api-Secret: <your secret>
Accept: application/json
Content-Type: application/json

Conventions

Money is {"amount": <integer minor units>, "currency": "BDT"} in your billing currency. A key with Amounts switched on the API access page gets currency units instead (15161.94).
Errors are {"error": {"code": "…", "message": "…"}}. Branch on code.
Ignore fields you do not know; new ones are added without notice.
Send an Idempotency-Key header when you book or order. The same request with the same key returns what was already made.

Times and ids differ by product; each guide lists its own.

API overview

Other APIs, not part of the partner guides:

Errors

Access errors are the same across the products. Each guide lists its own codes.

HTTP	error.code	Fix
`401`	`unauthenticated`	Headers missing, or key or secret wrong.
`401`	`credential_inactive`	Key revoked or expired.
`403`	`ip_whitelist_required, ip_not_whitelisted`	Whitelist your server's IP on the key.
`403`	`product_not_allowed`	The key is not enabled for this product.
`403`	`partner_inactive, subscription_*, environment_not_activated`	Account or API plan not active; live keys work after certification.
`429`	`rate_limited`	Wait a minute.

Retries

503, 429 and timeouts are safe to retry. Retry booking only with the same Idempotency-Key.

Updates

There are no webhooks yet. Read the booking to follow it: GET /flights/bookings/{booking_ref}, GET /hotels/bookings/{ref}.

Code examples

Every endpoint has examples in cURL, JavaScript, TypeScript, Python and PHP. Here is an eSIM order:

POST /esims/orders

curl -X POST "https://sandbox.flightota.com/api/v1/esims/orders" \
  -H "X-Api-Key: $FLIGHTOTA_API_KEY" \
  -H "X-Api-Secret: $FLIGHTOTA_API_SECRET" \
  -H "Accept: application/json" \
  -H "Idempotency-Key: sim-7731" \
  -H "Content-Type: application/json" \
  -d '{
  "place_code": "AE",
  "plan_id": "burj-mobile-7days-1gb",
  "quantity": 1,
  "email": "guest@example.com",
  "name": "Arif Rahman",
  "client_reference": "SIM-7731"
}'

Read the eSIM guide