What is NDC and why do I need an aggregator?

NDC (New Distribution Capability) is IATA's XML messaging standard for selling airline products. Every airline implements it differently. An aggregator gives you one integration that handles all those quirks.

How does pricing work?

You pay per request for data lookups (€0.01/request, first 50 free each month) and transaction fees when bookings, seats, or ancillaries are completed.

Getting started · Authentication

Authentication

Every `/v1/*` endpoint requires an `X-API-Key` header — including the health probe, the reference catalogue, the Aviation Data API and the authenticated Shopping / Orders surfaces. Requests without the header (or with an unknown key) are rejected with `401 Unauthorized`.

How to authenticate

Get your API key from the Norba dashboard, then send it as the `X-API-Key` header on every request.

# 1. Export the key issued from the dashboard
export NORBA_KEY="nbr_live_a8b…"

# 2. Send it as X-API-Key on every request — public or authenticated.
curl --request GET \
  --url https://api.norba.io/v1/aviation/airports \
  --header "X-API-Key: $NORBA_KEY"

curl --request POST \
  --url https://api.norba.io/v1/shopping/offers \
  --header "X-API-Key: $NORBA_KEY" \
  --header "Content-Type: application/json" \
  --data '{ "origin": "LHR", "destination": "JFK", "departure_date": "2026-06-15", "adults": 1 }'

API key details

Property	Details
Header name	X-API-Key
Format	Opaque string, prefixed with environment (nbr_live_, nbr_test_)
Where to get it	Norba dashboard → API Keys section
Environment	Test keys work on all endpoints. Live keys require a production subscription.
Rotation	Keys can be rotated from the dashboard. Old key remains valid for 24h after rotation.

Common auth errors

HTTP	Error code	Meaning
400	invalid_request	Missing or malformed field in the request body.
401	unauthorized	Missing or invalid API key.
403	forbidden	API key valid but agency lacks permission.