Skip to main content

Gets the current status of a booking attempt you created, by id.

GET 
/api/v1/FlightBooking/:attemptId

IDOR fix (2026-08-30 security review, CONFIRMED): this looked up an attempt by id alone -- unlike Cancel below, which resolves the caller's own wallet and checks attempt.WalletId against it -- so any authenticated caller (any end-user, or any agency's own valid API key) could read another caller's PNR/confirmed amount/failure reason by supplying any attemptId. Now mirrors Cancel's ownership check exactly, including its 404-not-403 anti-enumeration discipline.

Request​

Responses​

OK