Sandbox: real offers, real PNRs, no tickets

In the sandbox these endpoints work against real carrier test inventory: a search returns real offers and you can create a real booking with a carrier PNR. Two things are worth knowing before you build against them.

Sandbox orders are test reservations. Nobody flies on them, and they raise no fee. Cancel what you create; anything left over expires on its own payment time limit.
Sandbox orders are never ticketed. A paid order comes back confirmed with an empty tickets[] and a warning saying why. Read status and tickets[], not the HTTP code — that is the check production relies on too.

Orders

List orders

Every order stored for your agency, newest first.

GET/v1/ordersRequires X-API-Key

Lists the orders persisted against the agency behind your API key, newest first.Requires a key with an agency behind it — a developer-portal key or an agency key. A static key returns 401 unauthorized here, because there is no agency to scope the query to.Keyset pagination, not page numbers. limit sets the page size (1–100, default 20); cursor is the next_cursor from the previous page, and an empty next_cursor in the response means you have the last page. There is no page parameter. Filter with status, airline and pnr.Only orders Norba stored appear. A booking made with a static key exists at the airline but not here.

Request example

curl --request GET \
  --url https://api.norba.io/v1/orders \
  --header "X-API-Key: $NORBA_KEY"

Response example

{
  "orders": [
    {
      "order_id": "AA001Y1XD7ZA6",
      "pnr": "JBQGEY",
      "airline": "AA",
      "status": "confirmed",
      "currency": "EUR",
      "total_amount": 380.62,
      "created_at": "2026-08-14T09:15:00Z"
    }
  ],
  "next_cursor": ""
}

Authorization

X-API-KeystringRequired

Opaque API key issued from the Norba dashboard. Sent on every request as the X-API-Key HTTP header. Missing or invalid keys are rejected with 401 Unauthorized.

Query parameters

statusstring

pending, confirmed, ticketed, cancelled, partially_cancelled, disrupted, refunded, failed.

Example: confirmed

airlinestring

IATA airline code.

Example: AA

pnrstring

Exact record locator.

Example: JBQGEY

limitinteger

Page size. 1–100, default 20. Out of range returns 400 limit must be between 1 and 100.

Example: 20

cursorstring

Opaque pagination token from the previous page's next_cursor. Omit for the first page. An invalid value returns 400 invalid cursor.

Response fields

orders[]arrayRequired

Order summaries for this page.

next_cursorstringRequired

Pass as cursor to fetch the next page. Empty string means this was the last page.

Error codes

400

limit must be between 1 and 100, or invalid cursor.