API referenceenrichment
Get entry requirements
GET
/v1/enrichment/entry-requirementsAccepts X-Api-Key · oauthClientCredentials · bearer
Documents a traveller needs for a corridor; never an eligibility verdict
Tenant-scoped, Cache-Control private, TTL at most 24 hours.Show more
Tenant-scoped, Cache-Control private, TTL at most 24 hours. nationality and residence are personal attributes: never logged beside an order ref. The answer's shownAt is what an order keeps as evidence. Scope data:read.Query parameters
- originstringRequiredWhere the traveller departs from, as a country code (ISO 3166-1 alpha-2).
- destinationstringRequiredWhere the traveller enters, as a country code (ISO 3166-1 alpha-2).
- nationalitystringRequiredThe traveller's nationality, as a country code (ISO 3166-1 alpha-2).
- residencestringRequiredThe traveller's country of residence, as a country code (ISO 3166-1 alpha-2), when it differs from the nationality.
- purposestringOptionalThe reason for the trip, for example TOURISM, BUSINESS, TRANSIT, STUDY or WORK.
- stayDaysintegerOptionalHow many days the traveller stays.
- ageintegerOptionalThe traveller's age in years, where requirements differ for minors.
- transportstringOptionalHow the traveller arrives at the destination.
Request body
This operation takes no request body.
Responses
- 200data is EntryRequirementsEntryRequirementsResponse
- 400VALIDATION or UNKNOWN_DOMAINApiErrorResponse
- 401ApiErrorResponse
UNAUTHENTICATED — missing or expired token.Show more
UNAUTHENTICATED — missing or expired token. Declared on every operation because `security` is declared globally at the document root: every route is authenticated, so every route can answer 401. - 403ApiErrorResponse
AGENT_TIER_INSUFFICIENT, also 403, is a request whose agent tier does not allow the tool class; it carries nextAction verify_agent and details.tier, details.required, details.toolClass and…Show more
AGENT_TIER_INSUFFICIENT, also 403, is a request whose agent tier does not allow the tool class; it carries nextAction verify_agent and details.tier, details.required, details.toolClass and details.operationId. A ceiling only narrows an unverified caller and never widens a scope. - 405ApiErrorResponse
VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge).Show more
VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge). Not retryable as sent. - 414ApiErrorResponse
VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge).Show more
VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge). Not retryable as sent: send long input in the body of a POST. - 429ApiErrorResponse
RATE_LIMITED — the API key or its tenant is over a rate limit; wait for Retry-After, then retry.Show more
RATE_LIMITED — the API key or its tenant is over a rate limit; wait for Retry-After, then retry. Every routed request is counted against two token buckets, the key's and the tenant's (all its keys together): 50 requests a second with a burst of 100 on the standard plan. Every travel verb except polling a search also spends from a supplier budget, per key and per tenant: 10 requests a second with a burst of 20, and a plan may add a daily quota of supplier calls. Answers carry the IETF RateLimit header fields for the tightest bucket consulted (RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, RateLimit-Policy); a refusal adds Retry-After and details.scope (KEY or TENANT), details.budget (PLATFORM or SUPPLIER), details.reason (RATE or DAILY_QUOTA), details.tier and details.retryAfterMs. A sandbox may run with the limiter off, in which case none of these headers is sent. A search that is still warming is a different answer with a different meaning (keep polling). with the key-velocity check on, also details.reason VELOCITY_LIMIT, a soft breach of the API key's own scope (components/responses/VelocityLimited), nextAction slow_down. - 500INTERNAL — a bug, and traceId is the support handle.ApiErrorResponse
Errors you should handle
Branch on code and honour retryable — never on the HTTP status alone.
| 400 | VALIDATION message.intent.checkOut must be after message.intent.checkIn | not retryable |
| 400 | UNKNOWN_DOMAIN Unknown domain 'HOTELS'. Did you mean HTL? | not retryable |
| 401 | UNAUTHENTICATED The bearer token is expired. Re-authenticate and retry. | not retryable |
| 403 | PERMISSION_DENIED Role lacks the required scope: booking:write | not retryable |
| 403 | TAB_DISABLED Tenant acme-travel is not entitled to sell CRU | not retryable |
| 403 | OUT_OF_SCOPE The token's scope ladder does not reach this customer subtree | not retryable |
| 403 | TENANT_MISMATCH orderRef MO-8KD-2FQ-9XT does not belong to tenant acme-travel | not retryable |
| 405 | VALIDATION This method is not served. | not retryable |
| 414 | VALIDATION The request URI is longer than 8 KiB. | not retryable |
| 429 | RATE_LIMITED Too many requests for this key on the supplier budget. Wait for the Retry-After interval before trying again. | retryable |
| 500 | INTERNAL An unexpected error occurred. Quote the traceId to support. | retryable |