Skip to content
Wink

Overview

Lookup 33.0.2-SNAPSHOT

Section titled “Lookup 33.0.2-SNAPSHOT”

Partner Integrator API

Authenticated, usage-metered access to bookable travel inventory for API integrators. Query properties, availability and rates programmatically at scale under /api/partner/{managingEntityIdentifier}/. Requests are counted and rate-limited per account: a free tier applies until you subscribe to the metered paid tier. See the Partner API pricing & SLA page for current limits, per-request pricing and terms.

Authenticate with a bearer token in the authorization gRPC metadata header — the same token the REST surface accepts. Authorization is per account: every request carries a managingEntityIdentifier and is checked for INVENTORY:READ on it.

Generating a client

You call this API with a generated gRPC client, not with curl. Wink publishes the schema two ways:

  • Server reflection — the server describes itself, so grpcurl, Postman and Insomnia discover the schema at runtime with nothing to download. Reflection needs the same bearer token as any other call.
  • The .proto files, if you would rather vendor the schema and generate ahead of time.
grpcurl -H "authorization: Bearer $WINK_TOKEN" partner.wink.travel:443 list

Generating a Wink gRPC client walks through it with our schema. For the language-specific toolchain, see the official gRPC quick starts.

This is a gRPC API, not a REST API. Each operation is listed at the HTTP/2 path the transport really uses (/package.Service/Method, always POST), and the schemas are the proto3 JSON mapping of each message — so the contract is readable and model generation is correct. But these endpoints are not callable with an ordinary HTTP client: a real request body is a length-prefixed protobuf frame. Use a generated gRPC client, or the .proto schema published via server reflection.

Errors

Failures arrive as a gRPC status code in the response trailers, not as an HTTP status code:

Status Meaning
INVALID_ARGUMENT The request was malformed, or a required field was missing.
UNAUTHENTICATED Bearer token missing, expired or invalid.
PERMISSION_DENIED The token is valid but lacks the required grant on the account.
NOT_FOUND No record matched (only on operations that resolve a single record).
RESOURCE_EXHAUSTED Quota exceeded. Carries retry-after and x-ratelimit-* trailers — back off by the value given.

Information

  • OpenAPI version: 3.1.0

Operations

Section titled “Operations”
POST
/wink.partner.v1.Lookup/Get
POST
/wink.partner.v1.Lookup/Search

Authentication

Section titled “Authentication”

oauth2ClientCredentials

Section titled “oauth2ClientCredentials”

Every endpoint is protected with OAuth2 client credentials. Create an Application in your account to obtain a clientId and clientSecret, then exchange them for a short-lived bearer token.

1. Request an access token

POST to the Token URL below with Content-Type: application/x-www-form-urlencoded and a body of grant_type=client_credentials (optionally scope=<space-separated scopes>). Send your credentials as HTTP Basic auth: Authorization: Basic base64(clientId + ":" + clientSecret).

2. Call the API

Pass the returned token on every request: Authorization: Bearer <access_token>.

Tokens carry only the scopes granted to your Application — request the least privilege you need. There is no interactive authorize step and no refresh token for this flow; request a new token when the current one expires.

Security scheme type: oauth2

Flow type: clientCredentials

Token URL: https://dev-iam.wink.travel:9000/oauth2/token

Scopes:

  • inventory.read - View your inventory & rates.
  • inventory.write - Create and update your inventory & rates.
  • inventory.remove - Delete your inventory & rates.