Overview

NDC (New Distribution Capability) is a data exchange format based on Offer and Order management processes for airlines to create and distribute relevant offers to the customer.

The NDC Gateway API is the single point of access to route all the traffic to a third party vendor (Navitaire) implementing the features defined in the standard.

Enrollment Process

The NDC Gateway API is protected both by API Keys, which identify the API consumer app, and by JWT tokens, which verify the New Skies agent. In addition, the production environment is protected by an IP whitelist.

API Key

A valid API Key is required on every request to the NDC Gateway API, and you obtain it from within TUI's developer portal. Before you can request one, you must be a registered developer on the portal: if you haven't registered yet, follow the Getting started guide, which walks you through creating a developer account, setting up your Apps and retrieving the credentials needed to access our APIs.

When registering, identify flight-ndc-gateway-navitaire as the "API Product" and use the email address api.flightproduction@tui.com as the "Partner Manager Email". Once your registration is approved, you may create and manage your Apps directly to access the NDC Gateway API. Please be precise when naming your App, including a clear reference to identify yourself in the prefix (e.g. travelparadise.fr-packagesearch-app), as it will be required to complete the approval process and obtain the API Key.

JWT Tokens

When initiating a new working session, a new JWT token must be created and then used throughout the remaining API calls in that session. To obtain a token, log on with the New Skies agent credentials to start a session. For lost New Skies agent credentials, a password reset, or a new agent, contact api.flightproduction@tui.com with the request.

IP Whitelist

Access to the NDC Gateway production environment is restricted by an IP address filter. Once the workflow validation form is submitted and approved, the relevant production IP addresses are added to the whitelist, granting access to the API.

Note that accessing the NDC Gateway API production environment from any non-production environment is forbidden.

Testing Environment

To assist with integration, a playground (non-production) environment is available at https://playground.api.tui/flight/ndc. As with production, the playground requires both the API Key and JWT Token authorization methods.

The same API key created for the production environment can be reused, but the credentials for the JWT tokens are independent from the production ones. To request New Skies agent credentials for the non-production environment, send an email to api.flightproduction@tui.com with the following details:

Subject: New Skies Agent Request (non-prod)

Message Content: It should contain the application name and the contact address to send the credentials to.

IP whitelisting is not needed for the non-production environments.

Note: performing tests against the production API is strictly prohibited.

Workflow Validation

Access to the production environment requires a workflow validation prior to go-live. The following details must be provided:

• Contact details (general email address of the company)
• App name used on the developer portal for registration
• Production environment IP addresses or ranges
• Other environment IP addresses or ranges (e.g. the test/development environment)
• Brief description of the use case
• Endpoints used by the workflow, including a short description of the purpose of each request
• Overall workflow diagram
• Expected throughputs (requests per minute)

Defining and testing the use cases on the playground environment first is recommended, as it provides the details needed to facilitate validation and approval.

A test spreadsheet containing a set of test cases is also provided; these must be executed against the playground environment. The completed results must be attached to the validation request so the integration can be verified.

Note that missing information may delay the whitelisting and go-live.