API Terms of Use

1. Keys and secrets

API keys and secrets identify the Agency. They must be stored server-side, never in browsers, mobile apps or public repositories, and must be rotated on suspicion of compromise. The Agency is responsible for all requests signed with its secret.

2. Request signing

Requests are signed with TD-HMAC-SHA256 as described in the API reference. Timestamps must be within 300 seconds of server time and nonces must be unique. Bearer tokens are not supported.

• API Authentication with HMAC-SHA256 Signing

3. IP allowlist

Where an IP allowlist is configured for a key, requests from other addresses are refused. The Agency keeps the allowlist current.

4. Rate limits

Rate limits apply per Agency and are reported in response headers. Clients must honour Retry-After and must not retry in tight loops. Nothing is charged on a rate-limited request.

5. Caching and quotes

Prices and availability must not be cached or displayed from stale data. Every price shown to a Traveller must come from a current search or quote, and a booking must redeem a valid quote token.

6. Content rights

Product descriptions, images and other content delivered by the API may be displayed only to sell the Products through the Agency's channels during the Contract term. Content must not be redistributed to third parties or used to build competing catalogs.

7. Supplier anonymity

Where the API does not disclose an underlying supplier, the Agency must not attempt to identify it or contract around Rate Extra.

8. Suspension of access

Rate Extra may suspend keys immediately on abuse, security incidents or breach of these terms, and will inform the Agency of the reason where the law allows.

9. API changes and versioning

Backwards-compatible changes may be made at any time. Breaking changes are announced by email with reasonable notice and, where possible, offered under a new version. Deprecated behaviour remains available for the announced period.