API reference
Authorities
Each guarded handler declares one B2C authority. Missing token is 401. Wrong authority is 403.
POST /v2/auth/token is permitAll. It issues a token only when the linked user holds B2C_API_LOGIN. That authority does not authorize a booking call. The rest of the surface maps onto the block below.
B2C authority block
B2C_API_LOGIN (10313) issues the token and nothing else. B2C_FLIGHT_SEARCH (10300) · B2C_FLIGHT_DETAIL (10301) · B2C_CART_CREATE (10302) · B2C_CART_UPDATE (10303) · B2C_CART_VALIDATE (10304) · B2C_ORDER_SEARCH (10305) · B2C_ORDER_VIEW (10306) · B2C_TRAVELER_SEARCH (10307) · B2C_PNR_CREATE (10308) · B2C_ORDER_ISSUE (10309) · B2C_ORDER_CANCEL (10310) · B2C_FARE_RULE (10311) · B2C_REFERENCE_SEARCH (10312) · B2C_ORDER_REPRICE (10314).