Sandbox: real offers, real PNRs, no tickets

In the sandbox these endpoints work against real carrier test inventory: a search returns real offers and you can create a real booking with a carrier PNR. Two things are worth knowing before you build against them.

Sandbox orders are test reservations. Nobody flies on them, and they raise no fee. Cancel what you create; anything left over expires on its own payment time limit.
Sandbox orders are never ticketed. A paid order comes back confirmed with an empty tickets[] and a warning saying why. Read status and tickets[], not the HTTP code — that is the check production relies on too.

Servicing

Order history

Everything that happened to the booking — through Norba and, where the carrier exposes it, at the airline.

GET/v1/orders/{orderID}/historyRequires X-API-Key

The full timeline of an order, oldest first, from two records. Ours (source: "norba") is what passed through this API: who asked (actor: agency, support, system), the status it moved from and to, and a payload with what changed — the segments a partial cancellation dropped, the amount a refund was quoted at, what a change added. The airline's (source: "airline") is the carrier's own audit trail, where its connector can read it (Air France–KLM today): a disruption rebooking the airline did itself, a schedule change, a document its staff voided — the things that never came through here.airline_history says whether that side was included: included, unavailable (the carrier could not be read just now) or not_supported. GET /v1/orders/{orderID} still carries history[], our side alone in brief.A read — not blocked by the booking gate, and it raises no servicing fee.

Request example

curl --request GET \
  --url https://api.norba.io/v1/orders/{orderID}/history \
  --header "X-API-Key: $NORBA_KEY"

Response example

{
  "order_id": "AA001Y1XD7ZA6",
  "airline_history": "not_supported",
  "events": [
    {
      "event_type": "created",
      "occurred_at": "2026-09-19T10:02:11Z",
      "actor": "agency",
      "to_status": "confirmed",
      "source": "norba"
    },
    {
      "event_type": "seats_assigned",
      "occurred_at": "2026-09-19T10:09:40Z",
      "actor": "agency",
      "from_status": "confirmed",
      "to_status": "confirmed",
      "payload": {
        "seats": 1,
        "extras_amount": 23,
        "currency": "EUR"
      },
      "source": "norba"
    },
    {
      "event_type": "segments_cancelled",
      "occurred_at": "2026-09-21T08:15:02Z",
      "actor": "support",
      "from_status": "ticketed",
      "to_status": "partially_cancelled",
      "payload": {
        "segment_ids": [
          "SEG-2"
        ],
        "cancel_offer_id": "AA-RF2B…"
      },
      "source": "norba"
    }
  ]
}

Authorization

X-API-KeystringRequired

Opaque API key issued from the Norba dashboard. Sent on every request as the X-API-Key HTTP header. Missing or invalid keys are rejected with 401 Unauthorized.

Path parameters

orderIDstringRequired

Canonical order ID.

Example: AA001Y1XD7ZA6

Response fields

order_idstringRequired

The order.

events[]array<object>Required

event_type, occurred_at, actor, from_status, to_status, payload, source.

airline_historystringRequired

included, unavailable or not_supported.

Error codes

404

order_not_found — not this account's order.