Account Information API

Verify travelers using your site using their account details

The Account Information API includes details about each traveler. An Expedia agent will use it to verify the traveler’s unique identifier for purchases, loyalty redemption, cancellations, and more. This unique identifier can be a credit card number (a Payment Card Industry (PCI) identifier) or a non-PCI identifier such as email address or loyalty account number, depending on your requirements or security standards.

See Common data and responses for additional information.

Get account information

You’ll use this set of fields to fetch account info for a loyalty member or card holder using POST /user/v1/account.

Header

Request

You will need to set either membershipId, loyaltyAccountNumber, cardNumber, or email as a mandatory parameter. Your account manager will work with you to define which will work best based on your requirements.

Note: If you are using cardNumber as your identifier, you will also need to review the cardDetails and billingAddress tables below. No other parameters require this data.

Response

programAccount

cardDetails

billingAddress

users

Credit card encryption and decryption

If you use cardNumber as the traveler identifier for validation, some information will need to be encrypted. Expedia requires secure handling of PCI information using an industry-standard JWE (JSON web encryption) technique for encrypting and decrypting credit card details: asymmetric encryption using a public and private key pair.

Encryption use cases

The places where encryption should take place include:

• Request: cardNumber
• Response: cardDetails

In the request parameter, you should set up a 2048-bit CA (certificate authority)-signed RSA (Rivest Shamir Adleman) private key certificate and share it with Expedia. We’ll then use your public key to encrypt the cardNumber field using JWE and RSA.

In the response parameter, we’ll set up a 2048-bit CA-signed RSA private key and will share the corresponding public key certificate and share it with you. Using the Expedia public key, you’ll then encrypt each element of cardDetails using JWE and RSA.

We’ve laid out the steps to the encryption process below.

Encryption, step-by-step

Step 1: Fetch the public certificate and get the RSA 2048 public key.

1. Generate a random symmetric key (RSK) of 256 bits length.
2. Encrypt the RSK using the RSA 2048 public key using the algorithm RSA-OAEP-256.

Step 2: Generate a random initialization vector (IV) of 96 bits length.

Step 3: Encrypt plaintext data by using the RSK, IV, and the algorithm A256GCM to form the ciphertext and authentication tag data.

Step 4: Base64URL-encode the ciphertext to produce Base64URL (JWE ciphertext).

Step 5: Base64URL-encode the authentication tag, IV, RSK, and the JWE header JSON to produce:

• Authentication tag data: Base64URL (JWE authentication tag).
• IV: Base64URL (JWE initialization vector)
• RSK: Base64URL (JWE encrypted key)
• JWE header JSON: Base64URL (UTF8 (JWE header))

Then serialize the JWE object to its compact format consisting of Base64URL-encoded parts delimited by periods ('.') to produce:

Base64URL (UTF8) (JWE header) || '.' || Base64URL (JWE encrypted key) || '.' || Base64URL (JWE initialization vector) || '.' || Base64URL (JWE ciphertext) || '.' || Base64URL (JWE authentication tag)

public String encryptWithJWE(String plainText){
    X509Certificate publicCertificate = <fetch public cert>
    //get RSA public key
    final X509EncodedKeySpec publicKeySpec = new 
    X509EncodedKeySpec(publicCertificate.getPublicKey().getEncoded());
    final KeyFactory keyFactory = KeyFactory.getInstance("RSA");
    RSAPublicKey rsaPublicKey = (RSAPublicKey) keyFactory.generatePublic(publicKeySpec);
    //get keyID
    String keyID = certificateManager.getKid(publicCertificate);
    // Create JWE Header containing the needed metadata for encryption and decryption
    JWEHeader jweHeader = new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
        .type(JOSEObjectType.JWT)
        .customParam(IAT, System.currentTimeMillis())
        .keyID(keyID)
        .build();
/*

{
"alg":"RSA-OAEP-256",
"typ":"JWT",
"enc":"A256GCM",
"iat":<Time (in UTC) when JWE was issued, expressed in UNIX epoch time (seconds since 1 January, 1970)>,
"kid":<Key ID or subject key Identifier from the public key certificate>
}
*/
    JWEObject jweObject = new JWEObject(jweHeader, new Payload(plainText));
    RSAEncrypter encrypter = new RSAEncrypter(rsaPublicKey);
    jweObject.encrypt(encrypter);
    return jweObject.serialize();
    }

Decryption of card number in request

Expedia will encrypt cardNumber in the request. The decryption path is the reverse of the encryption path:

1. When you receive the encrypted JWE, you should decode the first section of the JWE, the JOSE header to determine the algorithm, the encryption, and the keyId (alg, enc, kid).
2. You’ll then validate the iat (issued-at: the time the JWT was issued) to make sure it’s no more than 5 minutes different from the current time. (The token will expire after 5 minutes.)
3. Next, fetch your private key and decrypt the JWE encryption key.
4. Then, using the decrypted RSK, the JWE initialization vector, and the JWE authentication tag, you can decrypt the JWE ciphertext parameter and verify it.

public String decryptJWE(String jweString) {
    PrivateKey privateKey = <fetch private key>;
    RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) privateKey;
    JWEObject jweObject = JWEObject.parse(jweString);
    JWEHeader jweHeader = jweObject.getHeader();validateJweHeader(jweHeader);
    RSADecrypter rsaDecrypter = new RSADecrypter(rsaPrivateKey);
    jweObject.decrypt(rsaDecrypter);
    return jweObject.getPayload().toString();
}

API details

Without credit card information

With credit card information