API reference
Authorities
Each guarded handler declares one B2C authority. Missing token is 401. Wrong authority is 403.
Login and refresh are permitAll. GET /v2/auth/me requires authentication but no extra authority. The rest of the surface maps one-to-one onto the block below.
B2C authority block
B2C_FLIGHT_SEARCH (10300) · B2C_FLIGHT_DETAIL (10301) · B2C_CART_CREATE (10302) · B2C_CART_UPDATE (10303) · B2C_CART_VALIDATE (10304) · B2C_ORDER_SEARCH (10305) · B2C_ORDER_VIEW (10306) · B2C_TRAVELER_SEARCH (10307) · B2C_PNR_CREATE (10308) · B2C_ORDER_ISSUE (10309) · B2C_ORDER_CANCEL (10310).