XAP API Sandbox Guidance

Overview
What is the Sandbox?
Requesting Sandbox Access
How to Use the Sandbox?
Supported APIs
- Lodging
- Flights
Response Behavior
- Mock response by Scenario

Overview

To support developers in building and testing integrations more efficiently, we offer a Sandbox environment for a curated set of APIs under Flights and Lodging domain. This environment simulates expected behavior using mock responses, helping partners test API requests without affecting live systems.

With Sandbox, you can experiment search, availability, reservations, and cancellations capabilities of Flights and Lodging APIs.

Note: The Sandbox currently supports limited dynamic behavior. Responses are mostly static, with only a subset of elements varying based on the request parameters.

What is the Sandbox?

The Sandbox is a non-production simulation layer that mimics real API behavior using stubbed responses. It is intended to help developers:

Validate API structure and parameter requirements.
Test request/response flows.
Understand response formats before integrating with production.
Simulate common error cases in a controlled setup.

Use the following base URL and header for all sandbox requests:

curl https://apim.sandbox.expedia.com \
-H 'Authorization: ••••••'

Please refer Basic-Authentication to understand how to authenticate your requests.

Key differences between sandbox and production environments:

Sandbox uses mock data and doesn't affect real inventory
Some features may be limited or simulated in the sandbox
Response times may differ from production

Requesting Sandbox Access

All sandbox endpoints are publicly accessible with the same API key or token mechanism used in production.

If you already have access to XAP API in production, you can use the same API Key and Password to access the sandbox environment. Otherwise, request sandbox access from your Expedia Account Manager.

How to Use the Sandbox

Our API Explorer provides a convenient Try-It-Out experience that lets you test Sandbox APIs directly from the browser without writing any code.

Follow these steps to get started:

Open the API Explorer
Go to the Sandbox Playground page.
Enter Authentication credentials
Enter your username and password in the Basic Authentication section.
Use the same credentials you use for production or the one given for Sandbox access.
Select the API
Choose the API you want to test from the available list.
Fill in Parameters
Use the sample values provided in this Sandbox guidance documentation to populate the request parameters.
Click Try It Out
Submit the request to view the mock response in the response section.
Use cURL Examples in Postman (Optional)
You can also copy the cURL requests provided in this documentation and run them directly in tools like Postman, Terminal, or other REST clients for testing outside the API Explorer interface.

Supported APIs

The following APIs currently support the Sandbox experience:

Lodging

API Name	Method & Endpoint	Description
Listings	GET /hotels/listings	Returns mock search results
Details	GET /hotels/details	Returns mock availability data
Booking	POST /hotels/bookings	Simulates booking initiation
Retrieve	GET /hotels/bookings	Returns mock details of a sample booking
Cancel	PUT /hotels/bookings	Simulates booking cancellation
Cancel Details	GET /hotels/bookings/canceldetails	Returns mock cancellation details of a sample reservation

Flights

API Name	Method & Endpoint	Description
Listings	GET /flights/listings	Returns mock flights search results
Details	GET /flights/details	Returns mock availability data of a chosen flight offer
Booking	POST /flights/bookings	Simulates booking initiation
Retrieve	GET /flights/bookings	Returns mock details of a sample reservation

This list is subject to expansion as we roll out sandbox support across more APIs.

Response Behavior

The mock responses are not fully dynamic or data-driven. Instead:

A limited set of fields (such as locationKeyword, ecomHotelIds etc) may influence the response content.
Other fields are stubbed or hardcoded for demonstration purposes only.

Mock Response Scenarios for API Testing

Lodging APIs

Search-to-Book API examples and possible error scenarios under Lodging line of business

Dateless Search

curl --request GET \
 --url `https://apim.sandbox.expedia.com/hotels/listings?ecomHotelIds=64187346` \
 -- header 'Authorization: ••••••'

Hotel Id Search

curl --request GET \
 --url `https://apim.sandbox.expedia.com/hotels/listings?checkIn=2025-09-01&checkOut=2025-09-05&ecomHotelIds=64187346` \
 -- header 'Authorization: ••••••'

Location Keyword Search

curl --request GET \
 --url `https://apim.sandbox.expedia.com/hotels/listings?checkIn=2025-09-01&checkOut=2025-09-05&locationKeyword=Seattle` \ 
 -- header 'Authorization: ••••••'

Details - valid offerToken in the request

curl --request GET \
 --url `GET https://apim.sandbox.expedia.com/hotels/details/CgcxMTYzNTI5EjIKCTMyNjA1MzkyMxIJMzk5O?price=901.26&currency=USD&locale=en_US` \
 -- header 'Authorization: ••••••'

Booking - valid offerToken in the request

curl --request POST \
 --url `https://apim.sandbox.expedia.com/hotels/bookings/CgcxMTYzNTI5EjIKCTMyNjA1MzkyMxIJMzk5O?price=901.26&currency=USD&locale=en_US` \ 
 -- header 'Authorization: ••••••'

Retrieve Booking - valid Itinerary Number in the request

curl --request GET \
 --url `https://apim.sandbox.expedia.com/hotels/bookings/79018026356` \ 
 -- header 'Authorization: ••••••'

Cancel Booking - valid Itinerary Number in the request

curl --request PUT \
 --url `https://apim.sandbox.expedia.com/hotels/bookings/79018026356` \ 
 -- header 'Authorization: ••••••'

Booking Cancel Details - valid Itinerary Number in the request

curl --request GET \
 --url `https://apim.sandbox.expedia.com/hotels/bookings/canceldetails/79018026356` \ 
 -- header 'Authorization: ••••••'

The examples above are provided for demonstration purposes only. The offerToken and itinerary numbers are mock values and do not represent actual bookings.

Below are some common error scenarios you may encounter when using the Lodging APIs in the Sandbox environment.

Listings Bad Request - No Results found error

curl --request GET \
 --url `https://apim.sandbox.expedia.com/hotels/listings?ecomHotelIds=987654321` \ 
 -- header 'Authorization: ••••••'

Listings Bad Request - Combined Search error

curl --request GET \
 --url `https://apim.sandbox.expedia.com/hotels/listings?ecomHotelIds=64187346&locationKeyword=Seattle` \
 -- header 'Authorization: ••••••'

Listings Bad Request - Ambiguous location error

curl --request GET \
 --url `GET https://apim.sandbox.expedia.com/hotels/listings?locationKeyword=amb` \ 
 -- header 'Authorization: ••••••'

Details Bad Request - invalid offerToken in the request

curl --request GET \
 --url `https://apim.sandbox.expedia.com/hotels/details/<some-random-token>` \ 
 -- header 'Authorization: ••••••'

Booking Bad Request - invalid offerToken in the request

curl --request POST \
 --url `https://apim.sandbox.expedia.com/hotels/bookings/<some-random-token>` \ 
 -- header 'Authorization: ••••••'

Flights APIs

Search-to-Book API examples and possible error scenarios under Flights line of business

Listings - One way search

curl --request GET \
 --url `https://apim.sandbox.expedia.com/flights/listings?segment1.origin=LAS&segment1.destination=FLL&segment1.departureDate=2025-09-01&adult=1` \
 -- header 'Authorization: ••••••'

Listings - Round trip search

curl --request GET \
 --url `https://apim.sandbox.expedia.com/flights/listings?segment1.origin=LAS&segment1.destination=FLL&segment1.departureDate=2025-09-01&segment2.origin=FLL&segment2.destination=LAS&segment2.departureDate=2025-09-11&adult=1` \
 -- header 'Authorization: ••••••'

Details - valid offerToken in the request

curl --request GET \
 --url `https://apim.sandbox.expedia.com/flights/details/v5-sos-9cf600b5edb24066bbdc70d03a9f2cd7-70-1~8` \
 -- header 'Authorization: ••••••'

Booking - valid offerToken in the request

curl --request POST \
 --url `https://apim.sandbox.expedia.com/flights/bookings/3e156944176b4f1099c26fd5347ee0b9-0-1~2?price=97.18&currency=USD` \
 -- header 'Authorization: ••••••'

Retrieve Booking - valid itinerary number in the request

curl --request GET \
 --url `https://apim.sandbox.expedia.com/flights/bookings/71261078088` \
 -- header 'Authorization: ••••••'

The examples above are provided for demonstration purposes only. The offerToken and itinerary numbers are mock values and do not represent actual bookings.

Below are some common error scenarios you may encounter when using the Lodging APIs in the Sandbox environment.

Listings Bad Request - missing segment details

curl --request GET \
 --url `https://apim.sandbox.expedia.com/flights/listings` \ 
 -- header 'Authorization: ••••••'

Details Bad Request - invalid offerToken in the request

curl --request GET \
 --url `https://apim.sandbox.expedia.com/flights/details/<some-random-token>` \ 
 -- header 'Authorization: ••••••'

Booking - invalid offerToken in the request

curl --request POST \
 --url `https://apim.sandbox.expedia.com/flights/bookings/<some-random-token>?price=97.18&currency=USD` \
 -- header 'Authorization: ••••••'