TravelCaster API - Authentication - GetAccessToken operation

Back to Authentication home.

To connect to the API you will need a username and a password. The API provides you with two passwords, one for the development environment and one for the production one. Depending on the password you send with your credentials, you will access one environment or the other.

The GetAccessToken operation returns a token created for a specific pair of username and password, determining the environment the following operations will be performed in. This token has an 8-hour TTL and has to be included in every request you send to the API from that step on.

Note: This page describes the AuthService GetAccessToken operation, available from API 1.7 on. If you are integrating against API 1.6 or below, use the legacy FlightService.GetAccessToken operation instead — see the migration guide for the differences between the two.

Request

JSON

http:///AuthService.json/GetAccessToken [POST]

body (application/json):

{
  "Username": "foo",
  "Password": "bar"
}
Field Type Description
Username string API username
Password string API password

No query-string mode is supported. Field names are PascalCase.

XML

http:///AuthService.xml/GetAccessToken [POST]

body (application/xml), or as a request query string param:

<GetAccessTokenRequest>
  <Username>foo</Username>
  <Password>bar</Password>
</GetAccessTokenRequest>

WebService

http:///AuthService.asmx

operation: GetAccessToken(GetAccessTokenRequest request)

<GetAccessToken>
  <request>
    <Username>foo</Username>
    <Password>bar</Password>
  </request>
</GetAccessToken>

SOAP messaging will not be available in upcoming versions of the API. Please plan your migration to JSON or XML accordingly.

Response

All requests return a structured object with the token valid for the username and password you provided. Be sure to use the correct password according to the environment you want to use.

JSON

{
  "Token": "a3f9b2c1D42",
  "ExpiresAt": "2026-05-22T20:00:00Z",
  "IDWeb": 12,
  "WebDescription": "My Agency",
  "TransactionCode": null,
  "TransactionMessage": null
}
Field Description
Token The session token to use in all subsequent requests
ExpiresAt UTC expiry (8-hour TTL)
IDWeb Web account identifier
WebDescription Agency/web name
TransactionCode Error code string (e.g. "1200") on failure; null on success
TransactionMessage Error description on failure; null on success

Check TransactionCode != null (or != "0") to detect an error — this replaces the API 1.6 behaviour of checking whether the plain-string response started with a numeric code.

Response headers

Header Description
X-API-User-IDWeb Web account identifier
X-API-User-WebDescription Agency/web name
X-API-Version Assembly version string

Transaction specific codes

  • 1200 - Invalid credentials
  • 1201 - Invalid credentials, user does not exist
  • 1203 - User not authorized for the API version being requested (API 1.7+ enforces version authorization — request access to the version from your account manager)
  • 1210 - Session expired, get new access token

Other transaction codes

  • 1000 - Unspecified error, see TransactionMessage
  • 1001 - Operation has timed out, retry

Back to Authentication home.

See change history for this file
Loading...