Changelog - Highstar Travel Developers

Skip to content
Developers
highstartravel.com
v2 Preview
v1
Guides API Reference Changelog
Developers
Getting started
Overview
Authentication
Sandbox
Booking flow
Booking flow
Products
Transfers
Tickets
Hotels
Fundamentals
Conventions
Errors
Resources
Migrating from v1
Changelog
Support
Questions about the API?
reservations@highstartravel.com
Resources
v2
Previous Migrating from v1 Next Support
View as Markdown
Open llms.txt
# Changelog

Changes to the public API, newest first. Changes that only add fields or endpoints do not break existing integrations.

## 2026-10-01: API v1 fixes

Response changes in API v1. Nothing was added or removed from the endpoints.

- Hotels: the replay of a confirmation (same `external_reference`) returns the same shape as the first answer, with `idempotent_replay: true`. It is answered before the rates are checked again, so an expired `rate_key` no longer hides a booking that exists. A credential in test mode does not get this shortcut.
- Hotels: `content/locations` no longer returns the supplier code of each location. To drill down, `country_id` and `division_id` are now our own ids: the `id` of a country or division row. The `country_id` and `division_id` of each row are integers (or `null`) with the same ids.
- Hotels: the `provider` field is gone from every response (rates and hotels in `hotelSearch`).
- Disney: cancelling again an order of yours that is already cancelled answers `200` with `{"success": true, "already_cancelled": true}`. Before, it answered `400`. A cancellation that fails midway keeps the tickets already cancelled, and a repeat only tries the rest.
- Disney: messages no longer name the supplier. The `error` labels and the HTTP codes are the same.
- Universal: `id_order` in a replay is a string, as in a new booking. Before, it was an integer.
- Universal: `ticketConfirm` only accepts products that are on sale. A PLU of a product that is not on sale answers like a PLU that does not exist: `400 Ticket not found.`.

## 2026-10-01: API v2 offers and guides

- The offer check is now `POST /offers/check` with the `offer_id` in the JSON body, instead of `POST /offers/{offer_id}/check`. The `offer_id` is a long signed token, and the body is where `POST /bookings` takes it too.
- `expires_at` is now `null` unless the source gives a real expiry. Today that is the Disney resort hotels, after the check. An offer without `expires_at` has no expiry time of its own. To know whether its price still holds, call `POST /offers/check`, which re-quotes live. The booking always re-quotes and answers `PRICE_CHANGED` (with the current offer), `NO_AVAILABILITY` or `OFFER_EXPIRED`. A hotel offer works while its stored search exists, about a day.
- The v2 guides are reorganized. [Booking flow](/developers/guides/v2-booking-flow) describes the steps every product shares. [Transfers](/developers/guides/v2-transfers), [Tickets](/developers/guides/v2-tickets) and [Hotels](/developers/guides/v2-hotels) cover only what is specific to each product. No endpoint changed.
- Tickets: new `GET /tickets/brands` lists each brand with its age categories and traveler requirements. In `GET /tickets/products`, `age_categories` and `booking_requirements` moved to the brand, the product keeps its own choices in `booking_options` (the old `options`), and every product has a `brand` (`UOR`, `WDW`, `DLR`, `UPR` or `OTKT`; never `null`).
- Hotel search has one way to follow it: `POST /hotels/availability` starts the search and answers at once; repeat `GET /hotels/availability/{search_id}` every `poll_after_seconds` until `status` is `completed` (`partial: true` means some sources did not answer). There is no `wait` parameter.

## 2026-10-01: API v2 preview, hotels

API v2 now covers hotels, as a preview, under `/api/v2`. This includes the Disney resort hotels.

- New endpoints: `GET /hotels/destinations`, `GET /hotels/{hotel_id}` for content, `POST /hotels/availability` to start a search and `GET /hotels/availability/{search_id}` to read it. Check, booking, reading, cancelling and the voucher use the same `/offers/check` and `/bookings` endpoints as the other products.
- The search is asynchronous. `poll_after_seconds` tells you when to ask again, `status` is `running` or `completed`, and `offset` and `limit` page the hotels (`total` and `next_offset` in the answer). `partial: true` says that part of the inventory did not answer.
- One offer per room. `hotels[].slots[]` has one entry per room you asked for, and `total` is the price of that room. The rooms of one rate share a `rate_group` and are booked together. `hotel_fees` are paid at the hotel and are not in `total`.
- Each offer carries its `booking_requirements`: some hotels need one holder, others every guest. The offers of Disney resort hotels have `requires_check: true`: the booking checks them for you, and `POST /offers/check` also returns the other packages of the room in `alternatives`.
- A hotel booking has one item per room, of the same hotel and stay. The hotel confirmation number is in `hotel_confirmation`, and `GET /bookings/{booking_id}/voucher?variant=hcn` downloads the voucher that includes it.
- The booking prices every room live again. A moved price answers `409 PRICE_CHANGED` with the current offer of that room.
- New error code: `SEARCH_NOT_FOUND` (`404`), for a search that does not exist, has expired or belongs to another company. New validation issue codes: `DATE_NOT_BOOKABLE` and `UNSUPPORTED_COMBINATION`.
- Change in tickets: when the provider does not answer and we cannot know whether it booked, the booking answers `502 PROVIDER_ERROR` and the `external_reference` stays tied to the attempt. A retry now answers `409 BOOKING_IN_PROGRESS` instead of creating a second booking. Look the booking up with `GET /bookings?external_reference=...`. The same applies to hotels. A rejection the provider states clearly still releases the reference.
- The v1 hotel endpoints are unchanged and have no end date.
- Guides: [Hotels](/developers/guides/v2-hotels) and [Migrating from v1](/developers/guides/v2-migrating-from-v1). Reference: [Hotels](/developers/reference/v2/hotels) and [Bookings](/developers/reference/v2/bookings).

## 2026-09-30: API v2 preview, tickets

API v2 now covers Universal and Disney tickets, as a preview, under `/api/v2`.

- New endpoints: `GET /tickets/products` and `POST /tickets/availability`. Booking, reading, cancelling and the voucher use the same `/bookings` endpoints as transfers.
- The catalog gives each ticket our `product_id` and the codes it has outside our platform in `external_id` and `external_ids`, and `booking_requirements` with the traveler fields and options to collect.
- Universal asks for first name, last name, birth date and nationality of every traveler. Disney asks for the same and accepts an optional phone. `options.delivery_method` (`eticket` or `kiosk_voucher`) is required when the product and your credential allow both.
- `availability` answers a price per category (`unit_prices`), a `total`, and one offer per time slot for products with slots. If some products cannot be priced, the answer carries `partial: true` and the others are returned.
- The booking prices the ticket live again. A moved price answers `409 PRICE_CHANGED` with the current offer and nothing is booked.
- Infants under 3 do not need a ticket and are not part of a ticket booking.
- The v1 Universal and Disney endpoints are unchanged and have no end date.
- Guides: [Tickets](/developers/guides/v2-tickets) and [Migrating from v1](/developers/guides/v2-migrating-from-v1). Reference: [Tickets](/developers/reference/v2/tickets) and [Bookings](/developers/reference/v2/bookings).

## 2026-09-30: API v2 preview, transfers

API v2 is available as a preview for transfers, under `/api/v2`.

- New flow: `GET /transfers/products`, `POST /transfers/availability`, optional `POST /offers/check`, then `POST /bookings`. Reading, cancelling and the voucher are on `/bookings/{booking_id}`, and `GET /bookings?external_reference=...` finds a booking by your reference.
- Prices come with a signed `offer_id`. The booking takes the `offer_id`, not the price. `expires_at` is `null` unless the source gives a real expiry.
- Every error uses `{"error": {"code", "message", "request_id", "details"}}` with a closed catalog of codes.
- The Bearer credential and the rate limit are the same as in v1. The v1 Transfers endpoints are unchanged and have no end date.
- Guides: [API v2 overview](/developers/guides/v2-overview), [Booking flow](/developers/guides/v2-booking-flow), [Transfers](/developers/guides/v2-transfers), [v2 errors](/developers/guides/v2-errors) and [Migrating from v1](/developers/guides/v2-migrating-from-v1).

## 2026-09-30: Transfers

The Transfers API was reworked to match the Disney API and is ready for partners.

- A Bearer credential is required on every Transfers endpoint. A request without it returns `401`. The `id_company` field is not accepted.
- `transferConfirm` takes a lead traveler: `pax[0]` with `name`, `surname`, `phone` and `nationality` (ISO 3166-1 alpha-2). Other passengers are optional and can be fewer than the booking. Before, every passenger had to be listed.
- Sandbox credentials now run the whole booking and keep a snapshot. You can cancel the test booking and download its voucher. The earlier `MOCK-TRANSFER-...` ids and the empty voucher are gone.
- New endpoint: `GET /api/v1/transfer/pdf?order_id=...` returns the voucher PDF of an order of your account.
- Every Transfers error uses the same envelope: `error`, `message`, `code`, `request_id`. This includes the answer of a cancellation that is not allowed.
- `getPrice` and `transferConfirm` return the same price for the same date and passengers.

## 2026-09-23: Disney

- `nationality` is required for every passenger and is checked against the ISO 3166-1 alpha-2 list. The alpha-3 code or the country name is converted.
- `phone` is optional. The passenger email is not used.
- `ticketConfirm` returns only `id_order` and `pdf_voucher`.

## 2026-09-22: Disney

The Disney endpoints were rewritten with the same shape as Universal: a catalog with one entry per product code, a price per unit and date, a direct confirmation, and `GET /api/v1/disney/pdf` for the voucher. Bearer is required. Adult and child tickets are separate product codes.

## 2026-09-05: Universal and hotels

- Universal `ticketConfirm` prices each ticket first and then multiplies by the quantity. The total matches the unit prices from `getTicketPrice` to the cent. Before, rounding on the total could differ by 0.01 and reject a correct `total_amount`.
- Hotels: `bookingCancelation` takes `id_orden`. `bookingDetail` and `bookingHcn` read a booking by `id_orden`. `bookingConfirm` returns the voucher link `pdf_voucher`. All `error` values are in English.

## 2026-09-01: Hotels

Every error from `/api/v1/hotel/*` has the same four fields: `error`, `message`, `code`, `request_id`. The `error` value is a stable label you can branch on. A supplier refusal is now `400 Booking rejected` or `400 Cancellation rejected`, with a short reason in `message`.

## 2026-08-26: Hotels, one room per slot

`hotelSearch` returns one slot per requested room, in the order of `occupancies`. `price` and `cancelation_fees[].amount` are per room. The total of a grouped rate is in `price_total` and `amount_total`. In `bookingConfirm`, `ratekey` has one entry per room. A grouped key repeated a wrong number of times returns `400 Invalid rate_key repetition`.

## 2026-08-23: Idempotency on every confirmation

Duplicate protection by `external_reference` (or the `X-Idempotency-Key` header) is active for all accounts on the four confirmation endpoints. See [Conventions](/developers/guides/conventions#idempotency).

## 2026-07-22: Hotels, adults only

Hotels that do not accept children carry `adults_only: true` and, when known, `adults_min_age`. The fields appear in `hotelSearch`, `hotelCheckPrice` and `content/hotelData`.

## 2026-07-04: Voucher links and idempotency

- Voucher links use a random key that cannot be guessed. Follow the URL that each confirmation returns.
- Confirmations accept `external_reference` to prevent duplicates. A repeat returns the same order with `idempotent_replay: true`, and a concurrent repeat returns `409 ORDER_CONFIRMATION_IN_PROGRESS`.

## 2026-05-09: Universal voucher endpoint

New endpoint: `GET /api/v1/universal/pdf?order_id=...` returns the voucher PDF of an order. The random-key link that `ticketConfirm` returns keeps working.
Support Changelog llms.txt highstartravel.com
↑ ↓ to move Enter to open Esc to close