Contact
Overview
Wink API 0.0.0-TEST
Section titled “Wink API 0.0.0-TEST”Welcome to the Wink API — a programmer-friendly way to manage, sell and book travel inventory on the Wink platform. See the Overview page (under API) for the full introduction, intended audience, testing, and versioning.
Webhooks API
Manage webhook subscriptions for a managing entity — endpoints, subscribed event types, signing secrets — and inspect the outbox: events addressed to the entity, per-endpoint deliveries and their attempts, with redelivery, cancel and test-event operations.
The Webhooks section below documents every event Wink POSTs to your endpoint: the JSON body
(WebhookEnvelope with an event-specific object), the Wink-* headers, the HMAC signature scheme
and the retry policy.
Authentication
Section titled “Authentication”oauth2ClientCredentials
Section titled “oauth2ClientCredentials”Every endpoint is protected with OAuth2 client credentials. Create an
Application in your account to obtain a clientId and clientSecret, then
exchange them for a short-lived bearer token.
1. Request an access token
POST to the Token URL below with Content-Type: application/x-www-form-urlencoded
and a body of grant_type=client_credentials (optionally scope=<space-separated scopes>).
Send your credentials as HTTP Basic auth:
Authorization: Basic base64(clientId + ":" + clientSecret).
2. Call the API
Pass the returned token on every request: Authorization: Bearer <access_token>.
Tokens carry only the scopes granted to your Application — request the least privilege you need. There is no interactive authorize step and no refresh token for this flow; request a new token when the current one expires.
Security scheme type: oauth2
Flow type: clientCredentials
Token URL: https://iam.wink.travel/oauth2/token
Scopes:
- integrations.read - View your channel manager integrations.
- integrations.write - Create and update your channel manager integrations.
- integrations.remove - Delete your channel manager integrations.
winkWebhookSignature
Section titled “winkWebhookSignature”HMAC-SHA256 signature: t=<unix seconds>,v1=<hex hmac(secret, t + "." + rawBody)> (a second v1 is present for 24h after a secret rotation). Verify against the RAW request body with your webhook’s secret (shown once on create/rotate), constant-time compare, and reject timestamps older than 5 minutes.
Security scheme type: apiKey
Header parameter name: Wink-Signature