What is NDC and why do I need an aggregator?

NDC (New Distribution Capability) is IATA's XML messaging standard for selling airline products. Every airline implements it differently. An aggregator gives you one integration that handles all those quirks.

How does pricing work?

You pay per request for data lookups (€0.01/request, first 50 free each month) and transaction fees when bookings, seats, or ancillaries are completed.

Getting started · Errors

Errors & rate limits

Every error has a consistent JSON shape: a machine-readable error code, a human message and a `request_id` you can quote when contacting support.

Error response format

All errors follow the same JSON structure regardless of which endpoint returned them:

Field	Type	Description
error	string	Machine-readable error code (see table below).
message	string	Human-readable explanation of what went wrong.
request_id	string	ULID you can provide to Norba support for tracing.

{
  "error": "unauthenticated",
  "message": "Missing or invalid API key.",
  "request_id": "01J3K…Z9"
}

Error codes

Every error returned by the API uses one of the following codes:

HTTP	Error code	Meaning
400	invalid_request	Missing or malformed field in the request body.
401	unauthorized	Missing or invalid Bearer token.
403	forbidden	Token valid but lacks permission for this resource.
404	not_found	The requested resource does not exist.
409	offer_expired	The OfferID is no longer valid — re-shop and try again.
422	order_validation_failed	Passenger data or payment data failed airline-side validation.
429	rate_limited	You have exceeded the rate limit. Retry-After header indicates when to retry.
502	airline_error	The upstream airline returned an error. The request_id is logged for diagnosis.
503	circuit_open	The adapter for this airline is in open-circuit state. Retry after 30 s.
504	airline_timeout	The upstream airline did not respond within the aggregator timeout window.

Rate limits

Rate limits are sliding-window per agency. On `429` the response carries a `Retry-After` header indicating how many seconds to wait before retrying.

Limit	Scope	Details
60 req/min	Per API key	General‑purpose endpoints (aviation data, health check).
30 req/min	Per API key	Shopping & Orders endpoints.
10 req/min	Per airline connector	Per‑airline rate limit when fanning out searches.