Authorization

Use Authorization: Bearer with a customer access token. Every resource must belong to the signed-in identity’s authorized set.

traveler:payments:checkout

Request headers

AuthorizationBearer · required: A Wincora customer access token for the Traveler audience.
Idempotency-Keyrequired: Stable key for this intended action. Reuse it for retries of the same request.

Path parameters

idstring · required: Opaque identifier in the authorized resource scope. Nested identifiers must belong to their parent resource.

Response

201Created

Returns the authorized resource or result for this operation. List results use items, nextCursor, and hasMore.

Behavior to account for

Every resource is filtered by the signed-in identity’s current relationships. Customer-account membership alone grants no access. Tokens cannot call Tenant or Visa Intelligence endpoints.

Order views omit other travelers and restricted fields. Financial details and checkout require a separate billing relationship; case access alone is insufficient.

Errors

Authentication failures return 401 or 403. Inaccessible resources return 404. Business and idempotency conflicts return 409. Rate limits return 429 with retry guidance.

Error handling guide

curl --request POST 'https://api.wincora.com/api/v1/traveler/orders/id_example/checkout-sessions' \ --header 'Authorization: Bearer CUSTOMER_ACCESS_TOKEN' \ --header 'Idempotency-Key: request-example-001'

const response = await fetch('https://api.wincora.com/api/v1/traveler/orders/id_example/checkout-sessions', { method: 'POST', headers: { "Authorization": "Bearer " + process.env.WINCORA_CUSTOMER_TOKEN, "Idempotency-Key": "request-example-001" } }); if (!response.ok) throw new Error(await response.text()); const result = await response.json();

import os import requests response = requests.request( 'POST', 'https://api.wincora.com/api/v1/traveler/orders/id_example/checkout-sessions', headers={ "Authorization": "Bearer " + os.environ["WINCORA_CUSTOMER_TOKEN"], "Idempotency-Key": "request-example-001" }, timeout=30, ) response.raise_for_status() result = response.json()