?brand=, while the HoJ API handles authentication,
brand allowlisting, tenant routing, and the upstream cart call.
Use this flow when you only need to create the cart from your product page and then let
the brand checkout own customer details, payment, and booking confirmation. If your
application needs to control every checkout step through API calls, use the full
Checkout flow instead.
These routes are internal only. Call them from your backend or serverless layer with
an internal HoJ API key. Do not expose the HoJ API key in browser JavaScript.
Handoff vs Checkout API
Flow
Inputs
Your product page needs a few stable values:brand: the HoJ distribution channel name or domain, for examplebrand.example.locale: the checkout locale, for exampleitoren.productId: either the numeric product id fromGET /v1/productsor the provider / trip code returned to internal clients.startDate: the trip start date inYYYY-MM-DDformat.adultsandrooms: traveler configuration for the first cart creation.affiliateId: optional tracking code agreed with HoJ / the brand channel.currency: optional currency, currentlyEUR,USD, orGBP.
Create The Cart
Create the cart from your backend:itineraryId; it is the cart identifier for later checkout, support,
or full internal checkout flows.
Build The Checkout URL
For a browser handoff, build a checkout URL using the resolved brand domain, locale, and itinerary id:GET /v1/distribution-channels and match by channel name or domainUrl.
Redirect Or Embed
The simplest handoff is a normal browser redirect:Frontend Helper Example
Your browser should call your backend, not the HoJ API directly:Fallback Product URL
If cart creation fails or the response does not contain anitineraryId, show a clear
error and offer a fallback link to the product page:
/checkout/{itineraryId}.
Operational Checklist
Before enabling a new product or brand:- Confirm the internal client has
profile=internalandallowedEntitiesincludesitineraries. - Confirm the brand is available in
GET /v1/distribution-channelsand allowed by the checkout proxy configuration. - Verify the product id or provider code with
GET /v1/products. - Test
POST /v1/itinerarieswith the chosenbrand,locale,startDate,adults, androoms. - Open the generated checkout URL in a browser and complete a test flow in the target environment.
- For iframe embeds, test Safari/iOS and other browsers with third-party storage restrictions.
Error Handling
The HoJ API returns problem-details errors. Treat any non-2xx response fromPOST /v1/itineraries as a cart creation failure and avoid sending the traveler to a
broken checkout URL.
Common cases:
400: invalid request body or date format.401: missing or invalid HoJ API key.403: client is not internal, lacksitineraries, or brand is not allowed.404: product or upstream cart resource was not found.429: quota exceeded.502: brand checkout upstream failed, timed out, or returned invalid JSON.
