Docs
Get an API key
Flight Webhooks

List your subscriptions

GET
/v1/flight/webhook-subscriptions

Your organisation's subscriptions, oldest first, without their signing secrets.

Authorization

x-api-key<token>

Your API key. Issued and revoked from the TrustPixel dashboard; the gateway resolves it to an owning organization on every request.

In: header

Header Parameters

x-request-id?string

Correlation id echoed to the upstream service and returned on the response. Generated as req_<uuid> when omitted.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/flight/webhook-subscriptions"
{  "data": [    {      "id": "whs_0192f3a4b5c64d7e8f9a0b1c2d3e4f5b",      "url": "https://partner.example/hooks/flight",      "event_types": [        "flight.booking.confirmed"      ],      "status": "ACTIVE",      "previous_secret_expires_at": "string",      "created_at": "string",      "updated_at": "string"    }  ]}

Buy bags for a booking POST

Buys bags on a confirmed booking with a saved card, as its own payment. The call is synchronous: success means the supplier confirmed the bags and Flight saved them and their totals. Payment capture is attempted before confirmation; a capture failure does not undo supplier-confirmed bags. Repeating an `x-idempotency-key` never charges or buys again: a completed purchase returns the current booking, a declined card returns 422 `payment_failed`, and a supplier refusal returns 422 `supplier_rejected`. A purchase that is still pending or has an unknown outcome returns 500 `result_unknown`, including on repeated requests. Do not submit it with a new key; it requires reconciliation. A new attempt after a known refusal or decline needs a new key.

Create a subscription POST

Register an HTTPS endpoint and the events it receives. You receive the signing secret only in this response, so store it on your server. Your organisation holds at most five subscriptions, one per URL, shared by all its credentials; a sixth or a repeated URL is a `409`.