Account Information API

The Account Information API includes details about each of your customers. Your template site will use this information as part of the single-sign-on (SSO) protocol to verify the user’s account. It will be used for purchases, loyalty redemption, and more.

This API can also be used by an Expedia agent to verify the traveler’s unique identifier (for example, credit card number) as part of the request to get the user account details. The details received will be used to validate the traveler on the phone before proceeding with shopping and booking for the traveler.

See the Common data and responses page for additional information.

Credit card encryption and decryption

Expedia uses an industry-standard JWE (JSON web encryption) technique for encrypting and decrypting credit card details: asymmetric encryption using a public and private key pair.

Encryption use cases

The places where encryption should take place include:

• Request: cardNumber
• Response: cardDetails

In the request parameter, you should set up a 2048-bit CA (certificate authority)-signed RSA (Rivest Shamir Adleman) private key certificate and share it with Expedia. We’ll then use your public key to encrypt the cardNumber field using JWE and RSA.

In the response parameter, we’ll set up a 2048-bit CA-signed RSA private key and will share the corresponding public key certificate and share it with you. Using the Expedia public key, you’ll then encrypt each element of cardDetails using JWE and RSA.

We’ve laid out the steps to the encryption process below.

Encryption, step-by-step

Step 1: Fetch the public certificate and get the RSA 2048 public key.

1. Generate a random symmetric key (RSK) of 256 bits length.
2. Encrypt the RSK using the RSA 2048 public key using the algorithm RSA-OAEP-256.

Step 2: Generate a random initialization vector (IV) of 96 bits length.

Step 3: Encrypt plaintext data by using the RSK, IV, and the algorithm A256GCM to form the ciphertext and authentication tag data.

Step 4: Base64URL-encode the ciphertext to produce Base64URL (JWE ciphertext).

Step 5: Base64URL-encode the authentication tag, IV, RSK, and the JWE header JSON to produce:

• Authentication tag data: Base64URL (JWE authentication tag).
• IV: Base64URL (JWE initialization vector)
• RSK: Base64URL (JWE encrypted key)
• JWE header JSON: Base64URL (UTF8 (JWE header))

Then serialize the JWE object to its compact format consisting of Base64URL-encoded parts delimited by periods ('.') to produce:

Base64URL (UTF8) (JWE header) || '.' || Base64URL (JWE encrypted key) || '.' || Base64URL (JWE initialization vector) || '.' || Base64URL (JWE ciphertext) || '.' || Base64URL (JWE authentication tag)

public String encryptWithJWE(String plainText){
    X509Certificate publicCertificate = <fetch public cert>
    //get RSA public key
    final X509EncodedKeySpec publicKeySpec = new 
    X509EncodedKeySpec(publicCertificate.getPublicKey().getEncoded());
    final KeyFactory keyFactory = KeyFactory.getInstance("RSA");
    RSAPublicKey rsaPublicKey = (RSAPublicKey) keyFactory.generatePublic(publicKeySpec);
    //get keyID
    String keyID = certificateManager.getKid(publicCertificate);
    // Create JWE Header containing the needed metadata for encryption and decryption
    JWEHeader jweHeader = new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
        .type(JOSEObjectType.JWT)
        .customParam(IAT, System.currentTimeMillis())
        .keyID(keyID)
        .build();
/*

{
"alg":"RSA-OAEP-256",
"typ":"JWT",
"enc":"A256GCM",
"iat":<Time (in UTC) when JWE was issued, expressed in UNIX epoch time (seconds since 1 January, 1970)>,
"kid":<Key ID or subject key Identifier from the public key certificate>
}
*/
    JWEObject jweObject = new JWEObject(jweHeader, new Payload(plainText));
    RSAEncrypter encrypter = new RSAEncrypter(rsaPublicKey);
    jweObject.encrypt(encrypter);
    return jweObject.serialize();
    }

Decryption of card number in request

Expedia will encrypt cardNumber in the request. The decryption path is the reverse of the encryption path:

1. When you receive the encrypted JWE, you should decode the first section of the JWE, the JOSE header to determine the algorithm, the encryption, and the keyId (alg, enc, kid).
2. You’ll then validate the iat (issued-at: the time the JWT was issued) to make sure it’s no more than 5 minutes different from the current time. (The token will expire after 5 minutes.)
3. Next, fetch your private key and decrypt the JWE encryption key.
4. Then, using the decrypted RSK, the JWE initialization vector, and the JWE authentication tag, you can decrypt the JWE ciphertext parameter and verify it.

public String decryptJWE(String jweString) {
    PrivateKey privateKey = <fetch private key>;
    RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) privateKey;
    JWEObject jweObject = JWEObject.parse(jweString);
    JWEHeader jweHeader = jweObject.getHeader();validateJweHeader(jweHeader);
    RSADecrypter rsaDecrypter = new RSADecrypter(rsaPrivateKey);
    jweObject.decrypt(rsaDecrypter);
    return jweObject.getPayload().toString();
}

Get account information

You’ll use this set of fields to fetch account info for a loyalty member or card holder using POST /user/v1/account.

Header

Request

Response

ProgramAccount

User information

Note: If any of the cardDetails fields are populated, those marked with a * are mandatory. All of the data in these fields are encrypted.

API details

Without credit card information

With credit card information