TravelShop Booking API

Getting started

The API is a plain REST API over HTTPS that returns JSON, authenticated with a single API key you generate yourself once your access is approved. The examples below use {BASE_URL} as a placeholder — your base URL is shown next to your key in the developer dashboard.

1. 1

   Apply

   Tell us about your platform. We review every request by hand, usually within 1–2 business days.

2. 2

   Generate your key

   Once approved, create your API key in the developer dashboard and register the IP addresses of the servers that will call the API. The key is shown only once.

3. 3

   Call the API

   Send the key as an X-API-Key header on every request. That is the whole handshake.

Authentication

Send your key in the X-API-Key header on every request. There is no OAuth flow, no token exchange and no expiry — the key stays valid until you regenerate or revoke it.

curl -X GET '{BASE_URL}/b2b/api/apiv2/b2c/tours/search?term=cappadocia&page_size=5' \
  -H 'X-API-Key: YOUR_API_KEY' \
  -H 'Accept: application/json'

const res = await fetch(
  '{BASE_URL}/b2b/api/apiv2/b2c/tours/search',
  {
    method: 'POST',
    headers: {
      'X-API-Key': process.env.TSB_API_KEY,
      'Content-Type': 'application/json',
      Accept: 'application/json',
    },
    body: JSON.stringify({ term: 'cappadocia', page_size: 5 }),
  },
)

const data = await res.json()

IP allowlist

Partner endpoints accept requests only from server IP addresses you have registered. Once your access is approved, add the public IP addresses your servers use for outgoing requests in the developer dashboard — up to 3 addresses by default.

• Register single IPv4 or IPv6 addresses. Ranges, private or reserved addresses and addresses owned by Cloudflare are refused.
• Use the address your server sends requests from, not your website's IP. If your website is behind Cloudflare, that address belongs to Cloudflare and cannot be registered.
• If your server has IPv6, requests may leave over IPv6. Register that address as well, or force your HTTP client to use IPv4. Run the commands below on the server itself to see both addresses.
• Changes take effect within about a minute.

curl -4 https://api.ipify.org
curl -6 https://api64.ipify.org

When a request is blocked

{
  "message": "This API key is not allowed from your IP address. Register it under Allowed server IPs in your developer dashboard.",
  "code": "ip_not_allowed",
  "ip": "203.0.113.10"
}

Rate limits & quotas

Two independent limits apply, both counted per partner — never shared with anyone else.

Exceeding either limit returns 429. Your current usage, broken down per endpoint, is visible in your developer dashboard.

Content rules

Tour search & content

Search the catalogue and pull full tour content. These are the endpoints most integrations start with.

Catalogue synchronization

Import complete public tour content and current retail departure schedules through two paginated change feeds.

curl -G '{BASE_URL}/b2b/api/products/modified-since' -H 'X-API-Key: YOUR_API_KEY' --data-urlencode 'count=100'

curl -G '{BASE_URL}/b2b/api/products/modified-since' -H 'X-API-Key: YOUR_API_KEY' --data-urlencode 'cursor=NEXT_CURSOR'

{
  "products": [
    {
      "tourId": 123,
      "slug": "example-tour",
      "modifiedAt": "2026-10-20T08:00:00+00:00",
      "status": "ACTIVE",
      "product": {
        "id": 123,
        "slug": "example-tour",
        "name": "Example tour",
        "itineraries": []
      }
    }
  ],
  "nextCursor": null,
  "syncStartedAt": "2026-10-20T09:00:00+00:00"
}

{
  "products": [
    {
      "tourId": 123,
      "slug": "example-tour",
      "modifiedAt": "2026-10-20T08:15:00+00:00",
      "status": "INACTIVE"
    }
  ],
  "nextCursor": null,
  "syncStartedAt": "2026-10-20T09:00:00+00:00"
}

curl -G '{BASE_URL}/b2b/api/availability/schedules/modified-since' -H 'X-API-Key: YOUR_API_KEY' --data-urlencode 'modified-since=2026-10-20T09:00:00Z'

{
  "availabilitySchedules": [
    {
      "tourId": 123,
      "slug": "example-tour",
      "modifiedAt": "2026-10-20T08:00:00+00:00",
      "rates": [
        {
          "rateId": 456,
          "startsAt": "2026-11-01",
          "endsAt": "2026-11-30",
          "minPax": 1,
          "maxPax": 20,
          "currency": "EUR",
          "departureTypeId": "scheduled",
          "description": {
            "en": "Standard departure"
          },
          "prices": {
            "regular": {
              "dbl": 200
            }
          },
          "dates": [
            "2026-11-05"
          ]
        }
      ]
    }
  ],
  "nextCursor": null,
  "syncStartedAt": "2026-10-20T09:00:00+00:00"
}

Pricing & availability

Live departure availability and B2C retail prices. Partner API keys do not provide access to supplier net prices.

Destinations & taxonomy

The reference data behind filters, menus and search boxes.

Enquiries & bookings

Create demand on our side from your platform. Everything you create here is attributed to your partner account and appears in your dashboard.

Deprecated response fields

Since 3 November 2026, tour search, tour detail and the product feed return the fields below as null. The keys stay in the response until 1 May 2027 so existing integrations keep parsing; after that date they are removed. Do not build on them.

Errors

Errors use standard HTTP status codes, with a JSON body carrying a message and — for validation failures — an errors object keyed by field name.

{
  "message": "The given data was invalid.",
  "errors": {
    "tour_id": ["The selected tour id is invalid."],
    "customers.0.email": ["The customers.0.email must be a valid email address."]
  }
}

Versioning