Build a traveler experience
Give each signed-in person the applications and actions they are authorized to use.
On this page
Acquire a customer token
Use your existing tenant login or Wincora-managed customer authentication. Both issue a Wincora customer access token for the Traveler API.
Start with GET /traveler/me to read the session identity and effective scopes. Use Bearer authentication for every Traveler request, including uploads and processing status.
Choose your authentication flowLoad authorized applications
GET /traveler/cases returns only cases permitted by the current identity’s relationships. Display customer-safe statuses and nextActions. The same case ID refers to the same underlying application in the Tenant API.
The tenant creates products, quotes, and orders through its backend. Traveler access starts with assigned applications and authorized order views. Visa Intelligence is not exposed through this token.
Applications and collectionCollect information and evidence
Render each case’s frozen requirements. Submit typed values, upload evidence, and follow the returned processing operation. Use the current resource version for state-sensitive changes.
Check readiness, then submit explicitly. Respond to later information requests using the same field, document, and answer resources. Processing completion is separate from staff review.
Collection workflowShow only permitted order and billing data
A case relationship does not grant access to every person on a multi-traveler order. Order projections omit other travelers and restricted fields.
Invoice totals and checkout require an explicit billing relationship and the relevant scope. Traveler tokens cannot record external settlements, approve refunds, or change tenant billing policy.
Orders and checkoutKeep the customer informed
Use case-scoped messages and optional collection assistance. Retrieve released deliverables using short-lived download grants. Internal staff notes, work queues, and operational reports never appear in these projections.
Tenant-wide event streams and webhooks belong to the Tenant API. Your backend can relay authorized updates to its users, or the Traveler client can refresh its scoped resources.
Messages, assistance, and results