TravelCaster API - Authentication - GetAccessToken operation

Back to Authentication home.

---

To connect to the API you will need a username and a password. The API provides you with two passwords, one for the development environment and one for the production one. Depending on the password you send with your credentials, you will access one environment or the other.

The GetAccessToken operation returns a token created for a specific pair of username and password, determining the environment the following operations will be performed in. This token has an 8-hour TTL and has to be included in every request you send to the API from that step on.

Note: This page describes the AuthService GetAccessToken operation, available from API 1.7 on. If you are integrating against API 1.6 or below, use the legacy FlightService.GetAccessToken operation instead — see the migration guide for the differences between the two.

Request

JSON

http:///AuthService.json/GetAccessToken [POST]

body (application/json):

{
  "Username": "foo",
  "Password": "bar"
}

Field	Type	Description
Username	string	API username
Password	string	API password

No query-string mode is supported. Field names are PascalCase.

Response

All requests return a structured object with the token valid for the username and password you provided. Be sure to use the correct password according to the environment you want to use.

JSON

{
  "Token": "a3f9b2c1D42",
  "ExpiresAt": "2026-05-22T20:00:00Z",
  "IDWeb": 12,
  "WebDescription": "My Agency",
  "TransactionCode": null,
  "TransactionMessage": null
}

Field	Description
Token	The session token to use in all subsequent requests
ExpiresAt	UTC expiry (8-hour TTL)
IDWeb	Web account identifier
WebDescription	Agency/web name
TransactionCode	Error code string (e.g. "1200") on failure; null on success
TransactionMessage	Error description on failure; null on success

Check TransactionCode != null (or != "0") to detect an error.

Response headers

Header	Description
X-API-User-IDWeb	Web account identifier
X-API-User-WebDescription	Agency/web name
X-API-Version	Assembly version string

Transaction specific codes

• 1200 - Invalid credentials
• 1201 - Invalid credentials, user does not exist
• 1203 - User not authorized for the API version being requested (API 1.7+ enforces version authorization — request access to the version from your account manager)
• 1210 - Session expired, get new access token

Other transaction codes

• 1000 - Unspecified error, see TransactionMessage
• 1001 - Operation has timed out, retry

---

Back to Authentication home.