Hotels API

OTP

Get a single-use token that signs an existing platform user in (single sign-on). It only works with a special API user.

POST/authentication/otp

Needs a special API user

This endpoint only works for an API user set up for it. Ask your Nava account manager to create one.

Request

Headers

auth-tokenstringrequiredSpec
A token from Authenticate.
Accept-EncodingstringrequiredDocs
gzip
Content-Typestringrequired
application/json

Body

userNamestringrequiredSpec
The existing platform user to sign in. Mind the capital N: Authenticate uses username.
micrositeIdstringrequiredSpec
The microsite id.

Response

The same shape as the Authenticate response.

200 OK

tokenstringSpec
A single-use token for single sign-on of that user.
expirationInSecondsinteger
Lifetime in seconds. The value for OTP tokens is not documented.

Behaviour

  • The token is single-use. Request a new one for every sign-in. Spec
  • It is for a user that already exists on the platform. Spec
  • Treat the token like a password and keep it out of logs.
  • How the token is handed to the platform for sign-in depends on your setup. Ask your Nava account manager.

Authenticate

Exchange your API username, password and microsite id for a token. Every other endpoint needs it in the auth-token header, and one token must carry a whole booking flow.

Quote

Search up to 3,000 hotel codes or one destination for available rooms. Each combination in the response carries the combinationKey you send to Confirm.