Travel booking APIs explained: what developers can integrate for flights, hotels and more

A travel booking API lets your software search, price and book travel inventory directly. The main types are GDS APIs (Amadeus, Sabre, Travelport), airline NDC connections, flight aggregators such as Duffel, and hotel and activity APIs from Expedia, Booking.com and Viator. They differ most on who issues the ticket and who takes the payment.

Here is what each type gives you, what access takes, and what a working integration actually involves.

What is a travel booking API?

A travel booking API is a set of web endpoints a supplier or intermediary exposes so your code can shop and sell its inventory. Instead of searching a supplier website, your app sends a request and gets offers back.

Most flight APIs follow the same arc. Travelport describes its air workflow as search, price, book, ticket, cancel, and more. Hotel and activity APIs follow a similar search, check, book and cancel pattern.

The API is the easy part. The hard parts are access, ticketing, payments and the rules each provider attaches to its data.

What types of travel booking APIs are there?

GDS APIs: Amadeus, Sabre and Travelport

A global distribution system (GDS) is the network airlines, hotels and agencies have long used to sell travel. The three big ones publish developer portals.

Amadeus now offers enterprise access only. Its pay-as-you-go Self-Service APIs for independent developers and start-ups have been deprecated, and Amadeus archived their developer guides on July 17, 2026. Amadeus says its Enterprise Portal and Enterprise APIs remain fully available.

Enterprise access is granted only on request, with an implementation fee and monthly fees. Ticketing is the other gate. Amadeus says IATA or ARC licenses are mandatory to issue flight tickets, and that option exists only in Enterprise. Self-Service users had to ticket through an airline consolidator, a wholesaler that issues tickets for you.

Travelport offers instant trial access with no payment required on its developer portal. Its public pages don't spell out production or ticketing requirements, so ask Travelport sales before you plan around them.

Sabre runs its own developer portal, Sabre Dev Studio. Confirm its production and ticketing rules with a Sabre account manager before you build.

IATA NDC: the airline standard

New Distribution Capability (NDC) is not a product you sign up for. IATA defines it as a data exchange format based on Offer and Order management processes.

The standard is open to any third party, intermediary, IT provider or non-IATA member, on a voluntary basis. IATA's board backed the program in Resolution 787, dated October 2012.

What this means for agencies: you reach NDC content through an airline's own NDC connection or through a provider that has already connected to it. You still need ticketing authority or a partner who has it.

Flight aggregator APIs

Aggregators sit between you and many airlines and expose one modern API. Duffel is a well-known example. The details below are Duffel's own vendor documentation.

Duffel gives you two ways to pay airlines. The arc_bsp_cash type is for registered IATA travel agents using their own airline relationships. The balance type is for Managed Content, where Duffel's pricing page offers access to its 5 IATAs worldwide with no additional forms or up-front capital.

As listed on Duffel's pricing page in October 2026 (in US dollars), that costs $3.00 per confirmed order, plus 1% of total order value for Managed Content. There is also $0.005 per excess search above a 1,500:1 search-to-book ratio.

Hotel APIs: Expedia Rapid and Booking.com Demand

Expedia Group's Rapid API covers hotels, vacation rentals, cars, flights and more. Access is gated: you need to be an Expedia partner, and applications are reviewed case by case.

**Booking.com's Demand API** covers accommodation, car rentals and attractions. You must be registered as a Booking.com Managed Affiliate Partner, and Partner Centre access comes from your Account Manager after signing the agreed contract.

Activities APIs

Viator's Partner API is a public example. Creating an affiliate account gives you Basic Access right away. Full or Full + Booking access requires meeting basic qualifications.

Only the higher tiers can book. Full-access affiliates get everything except booking, booking hold and cancellation endpoints. Booking affiliates and merchant partners get the transactional ones.

Travel booking API types compared

As documented by each provider, checked October 2026.

The merchant of record is the business that charges the traveler and answers for the transaction. Viator describes it as taking full responsibility for all financial records and transactions, plus support, cancellations and refunds.

What does a travel API integration involve?

Every booking runs through the same five steps. Each one has its own failure points.

1. Search. You send dates, places and travelers. Duffel calls this creating an offer request.
2. Price. Search results go stale, so you re-check the price. Duffel warns that offers get stale fairly quickly, and then you can't book them.
3. Book. You submit travelers and payment. Duffel's order comes back with the airline's booking reference.
4. Ticket or confirm. For flights, a party with ticketing authority issues the ticket. The ticketing section below covers who that can be.
5. Service. Changes, cancellations and refunds. Duffel cancels in two steps: an unconfirmed cancellation quote, then confirmation. The quote shows the refund amount and expires.

Plan for duplicate submissions too. Expedia requires an affiliate_reference_id on every booking to prevent duplicate bookings and duplicate charges.

How do sandbox and production access work?

Every provider gives you a test environment first. Production is a separate gate.

• Expedia Rapid. Test bookings on the test endpoint don't create real reservations or charges. After a site review, your business development manager enables the key for production.
• Viator. A sandbox server uses test data. Merchant partners must pass certification before going live.
• Duffel. Test tokens see only test resources, and live tokens are enabled once you activate your account.

Budget time for certification. It is a review of your screens and logs, not only your code.

Who issues the ticket?

Someone with ticketing authority. For IATA member airlines, Amadeus notes that only certain accredited parties can issue tickets.

That gives you three routes. Hold your own accreditation (see what IATA codes are). Use a consolidator. Or use a provider's accreditation, as with Duffel's Managed Content. The API doesn't remove the accreditation question. It moves it.

If you don't have a code yet, read how to sell flights without an IATA code.

How do payments and PCI scope work with a travel API?

If you take cards, PCI DSS applies to you. Stripe puts it plainly: anyone involved with the processing, transmission, or storage of card data must comply.

The question is how much. Handling raw card numbers yourself can mean meeting more than 300 security controls. Tokenized forms keep card data off your servers and reduce your PCI obligations. You still have to attest to compliance every year.

Travel providers work the same way. Duffel's card form returns a card ID, so card details never touch your servers. Expedia asks partners to comply with PCI DSS and, in some models, to supply an Attestation of Compliance.

An embedded payment form doesn't end your duties. The PCI Security Standards Council says merchants using one must still confirm their page is not open to script attacks (FAQ 1588, February 2025).

Tokenize, don't touch. Then decide who charges the traveler. If you are the merchant of record, refunds and chargebacks land on you. For the wider picture, see how travel agencies collect payments.

What rate limits and caching rules apply?

Every provider limits traffic, and each counts it differently.

• Expedia Rapid: limits are calculated monthly from your traffic versus revenue. New partners get a generous allowance for the first 3 months.
• Duffel: the excess search fee above 1,500:1 works as a soft limit on browsing without booking.

Caching rules are just as specific. Expedia lets you store reviews locally for 48 hours. Viator says tags should be cached and refreshed weekly and search endpoints must not be used for ingestion.

Display rules matter as much. Expedia requires the total price to match the API response, with no rounding or currency conversion, and the cancellation policy shown before final confirmation.

Should you build your own integration or buy one?

Practical guidance, not a provider rule. Building is a product, not a project. You take on ticketing, certification, PCI scope and servicing for each provider you add.

Build when booking is your product, you have developers who will maintain it, and you already hold accreditation or a consolidator contract.

Buy when you sell travel rather than software. A platform that already holds the connections, ticketing route and payment setup gets you selling sooner. Check how it handles auto-cancellation of unpaid bookings before you commit.

Start narrow either way. One flight source and one hotel source, live and certified, beats five half-built integrations. For where booking fits in the bigger setup, see how to start a travel agency.

How Tripdash handles bookings by API

Tripdash Bookings is a booking API for "cruises, flights, hotels and other tickets that developers can integrate into their own application." You can book without an IATA code or building supplier contacts. Tripdash Pay also sits under an API umbrella, so partners and platforms can integrate it. See how Tripdash Bookings works.

Sources

1. Amadeus for Developers. FAQ, last updated April 20, 2026 (archived July 17, 2026).
2. Amadeus for Developers. Developer guides repository (deprecated), archived July 17, 2026.
3. Amadeus. Statement regarding Amadeus for Developers portal, 2026.
4. Amadeus for Developers. Flights.
5. Travelport. Developer portal.
6. Sabre. Sabre Dev Studio.
7. IATA. New Distribution Capability (NDC).
8. Duffel (vendor). Getting started with flights.
9. Duffel (vendor). Getting started with Duffel.
10. Duffel (vendor). Pricing, checked October 2026.
11. Duffel (vendor). Paying with customer cards.
12. Duffel (vendor). Cancelling an order.
13. Expedia Group. Developer docs.
14. Expedia Group. Rapid: get started.
15. Expedia Group. Rapid API partner application.
16. Expedia Group. Lodging API pre-launch requirements.
17. Expedia Group. Rate limiting.
18. Expedia Group. Optimization tips.
19. Booking.com. Demand API overview.
20. Booking.com. Demand API prerequisites.
21. Booking.com. Demand API payments overview.
22. Viator. Partner API technical documentation.
23. Viator. Affiliate API.
24. Viator. Viator API certification, July 15, 2025.
25. Stripe. Integration security guide.
26. PCI Security Standards Council. FAQ 1588: How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts?, February 2025.