Sandbox: real offers, real PNRs, no tickets

In the sandbox these endpoints work against real carrier test inventory: a search returns real offers and you can create a real booking with a carrier PNR. Two things are worth knowing before you build against them.

Sandbox orders are test reservations. Nobody flies on them, and they raise no fee. Cancel what you create; anything left over expires on its own payment time limit.
Sandbox orders are never ticketed. A paid order comes back confirmed with an empty tickets[] and a warning saying why. Read status and tickets[], not the HTTP code — that is the check production relies on too.

Orders

Retrieve order

Full current state of an order — passengers, itinerary, seats, tickets, payments and audit history.

GET/v1/orders/{orderID}Requires X-API-Key

Reads the order scoped to your agency. By default it is answered from Norba's copy of the order — safe to poll, and it never reaches the airline.?refresh=true asks the airline instead.** The order is read from the carrier, what it returns is stored, and that is what you get back — the current status, tickets and payments as the carrier holds them. Use it after a delayed payment, when a ticket may have been issued since you last looked, or whenever the carrier may have acted without telling you. A refresh is a metered airline call.**An id this account does not hold is 404, whatever you send.** Knowing an order id is not proof of ownership — retrieval is scoped to your agency's key.The 404 names what to check and, when it can, what you probably meant. It carries code: "order_not_found" and a message telling you to copy order_id out of the JSON rather than retype it, and — when your agency holds an order id exactly one character away from the one you sent — a did_you_mean suggestion. Airline order ids interleave letters and digits (AA001HKO571A3), so O/0 and I/1 typos are the overwhelming cause of this 404; two equally-close candidates, or a real difference of more than one character, get no suggestion, because a wrong hint could point you at cancelling a booking you did not mean.The response is the same canonical Order that POST /v1/orders returns, including history[] — our timeline, in brief. GET /v1/orders/{orderID}/history is the full version, merged with the airline's own record where the carrier exposes one.

Request example

curl --request GET \
  --url https://api.norba.io/v1/orders/{orderID} \
  --header "X-API-Key: $NORBA_KEY"

Response example

{
  "order_id": "AA001Y1XD7ZA6",
  "airline_order_id": "AA001Y1XD7ZA6",
  "pnr": "JBQGEY",
  "airline": "AA",
  "status": "confirmed",
  "created_at": "2026-08-14T09:15:00Z",
  "expires_at": "2026-08-17T21:59:00Z",
  "currency": "EUR",
  "total_amount": 380.62,
  "passengers": [
    {
      "id": "PAX96101",
      "type": "ADT",
      "first_name": "MARIA",
      "last_name": "GARCIA"
    }
  ],
  "slices": [
    {
      "origin": "BCN",
      "destination": "JFK",
      "stops": 0,
      "segments": [
        {
          "flight_number": "AA67"
        }
      ]
    }
  ],
  "history": [
    {
      "event_type": "created",
      "occurred_at": "2026-08-14T09:15:00Z",
      "actor": "agency"
    }
  ]
}

Authorization

X-API-KeystringRequired

Opaque API key issued from the Norba dashboard. Sent on every request as the X-API-Key HTTP header. Missing or invalid keys are rejected with 401 Unauthorized.

Path parameters

orderIDstringRequired

Canonical order ID, e.g. AA001Y1XD7ZA6.

Example: AA001Y1XD7ZA6

Query parameters

refreshboolean

true asks the airline for the order's current state and stores what it returns before answering. Omit it to read Norba's copy without an airline call.

Example: true

Error codes

404

order_not_found — no order with that id in your agency's store, and no airline is asked. Carries did_you_mean when one of your agency's own orders is exactly one character away.