API reference

Overview

AeroLink is the B2C surface of a full flight stack — two services, one booking journey, seventeen endpoints.

If you run a travel website under your own brand, you should not have to rebuild search, cart, PNR and ticketing. AeroLink gives your storefront a customer-safe contract: live flights, a fare the shopper can understand, and a booking that belongs only to that customer.

The public base is https://api1.vacaychi.com. Auth is under /user. Flights, cart, orders and travellers are under /booking. Both speak /v2.

Response

200

{
  "message": "Success",
  "data": {},
  "error": null,
  "timeStamp": "02-09-2026 15:30:00"
}

Base URLs

User (auth): https://api1.vacaychi.com/user — /v2/auth/* Booking (everything else): https://api1.vacaychi.com/booking — flights, cart, orders, travellers.

Tenant and storefront

Every request is tenant-routed before authentication, from the Host subdomain (default base domain trip963.com). A B2C storefront is not its own tenant — it runs on the founding tenant. Its subdomain must be listed as reserved, or the API rejects the call with 400 before any B2C code runs.

Authentication model

POST /v2/auth/token is open. Send accessKey and secret. The response is an accessToken and expiresIn. There is no refresh cookie. Everything else needs Authorization: Bearer <accessToken>. When the token expires, call /v2/auth/token again. The caller IP must stay on the client allow-list for the token call and for every later /v2 call.

Success envelope

Every success is a ResponseModel. Timestamp format is dd-MM-yyyy HH:mm:ss.

Money the customer sees

Amounts are a nine-field B2cFare, already converted into the caller’s POS currency. No B2C payload contains agentPrice, costing, MRP, commission, markup, PCC or provider. total is what the customer pays — agent fare plus the storefront markup, charged once per booking.

Paging

Search endpoints return content, page, size, totalElements, totalPages, last. Query params are pageNum (default 0) and pageSize (default 10).