Sandbox: real offers, real PNRs, test tickets

In the sandbox these endpoints work against real carrier test inventory: a search returns real offers and you can create a real booking with a carrier PNR. Two things are worth knowing before you build against them.

Sandbox orders are test reservations. Nobody flies on them, and they raise no fee. Cancel what you create; anything left over expires on its own payment time limit.
Sandbox tickets are test documents. A paid order comes back ticketed with test ticket and EMD numbers in tickets[]; a hold comes back confirmed with none. Read status and tickets[], not the HTTP code — that is the check production relies on too.

Servicing

Confirm a cancellation

Cancel the order and get the cancelled order back — unlike DELETE, which returns no body.

POST/v1/orders/{orderID}/cancel/confirmRequires X-API-Key

Cancels the order at the airline, then re-reads it and returns the updated canonical Order with status: cancelled, persisting the new state.

Partial cancellation. With segment_ids only those flights are dropped and the order comes back partially_cancelled (or wherever the airline says it now is), still alive for the rest. Pass the quote_id from POST /v1/orders/{orderID}/cancel for the same segments as cancellation_quote_id: on carriers that cancel by accepting an offer (American) it is the offer being accepted, and the refund is then the one quoted. The timeline records segments_cancelled with the segments and the offer.

**Choose this over DELETE /v1/orders/{orderID} when you want the resulting order object.** DELETE does the same cancellation but answers 204 with no body.

If the post-cancel re-read fails, the response degrades to a minimal {"order_id", "status"} rather than failing the call — the cancellation already happened at the airline, and reporting a 5xx would push clients into retries against an order that is already closed.

cancellation_quote_id in the body is accepted but not validated against the quote.

Idempotency. Send an Idempotency-Key (up to 128 characters) and keep it across retries, as on every write. A whole-order cancellation shares its key with DELETE /v1/orders/{orderID}, so a retry through either route is answered from the first. A key still in flight, or another write still running on the order (409 order_busy), answers 409 with Retry-After. A refusal from the airline is 422 airline_refused; a cancellation that never reached the airline is 503 airline_unreachable with Retry-After.

?airline= is optional: the airline comes from your stored order, not from this parameter. A value that disagrees with the persisted carrier is refused with 400 airline does not match the order.

Request example

curl --request POST \
  --url https://api.norba.io/v1/orders/{orderID}/cancel/confirm \
  --header "X-API-Key: $NORBA_KEY" \
  --header "Content-Type: application/json" \
  --data '{ "cancellation_quote_id": "qte_01K2M8ZC3AC5N8" }'

Response example

{
  "order_id": "AA001Y1XD7ZA6",
  "pnr": "JBQGEY",
  "status": "cancelled",
  "currency": "EUR",
  "total_amount": 380.62
}

Authorization

X-API-KeystringRequired

Opaque API key issued from the Norba dashboard. Sent on every request as the X-API-Key HTTP header. Missing or invalid keys are rejected with 401 Unauthorized.

Path parameters

orderIDstringRequired

Canonical order ID.

Example: AA001Y1XD7ZA6

Query parameters

airlinestring

IATA code. Optional — inferred from your stored order. A value that disagrees with the persisted carrier is refused with 400 airline does not match the order.

Example: AA

Request body

cancellation_quote_idstring

The quote you are accepting. On a whole-order cancel it is advisory; on a partial one it is the cancel offer the airline is asked to accept.

segment_idsarray<string>

Drop only these flights — a partial cancellation. Empty cancels the whole booking.

Error codes

400

invalid json, or airline does not match the order when a supplied ?airline= disagrees with the persisted carrier.

409

illegal_transition — the order's status cannot move to cancelled (or partially_cancelled); order_busy or idempotency_key_in_flight (with Retry-After); idempotency_key_reused; or cancel_outcome_unknown (code, with attempt_id).

422

airline_refused — the airline rejected the cancellation; or partial_cancel_unavailable.

502

Only with code: "cancel_outcome_unknown", attempt_id and Retry-After: the cancellation reached the airline and its answer was lost — read the order back with ?refresh=true before sending it again.

503

coming_soon — order writes disabled; or airline_unreachable with Retry-After — nothing reached the airline.