generated: '2026-08-01'
method: searched
source: https://ndc.flybreeze.com/docs/ndc-for-developers/authentication
docs: https://ndc.flybreeze.com/docs/ndc-for-developers/authentication
api: Breeze Airways NDC Gateway
summary:
  types:
  - apiKey
  - http-basic
  - http-bearer
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
  network_controls:
  - ip-allowlisting
notes: >-
  Derived by reading the Breeze Airways NDC gateway authentication documentation.
  Breeze publishes no OpenAPI or machine-readable security scheme document, so this
  profile is transcribed from the published route/authorization table and the token
  request/response samples on the authentication page. Every request to the gateway
  carries a per-partner Azure API Management subscription key; most routes then
  additionally require a short-lived session bearer token.
schemes:
- name: SubscriptionKey
  type: apiKey
  in: header
  parameter_name: Ocp-Apim-Subscription-Key
  required: true
  applies_to: all routes
  description: >-
    Azure API Management subscription key, unique per partner and per environment
    (sandbox vs production). It does not rotate per session. A missing or incorrect
    value returns 401 Access Denied with a WWW-Authenticate AzureApiManagementKey
    response header.
  source: https://ndc.flybreeze.com/docs/ndc-for-developers/authentication
- name: BasicAuth
  type: http
  scheme: basic
  applies_to:
  - POST /api/Selling/r3.x/Auth
  description: >-
    Base64 encoded agency credentials presented on the Authorization header of the
    token request only. Credentials are issued by Breeze and delivered over a secure
    Bitwarden Send link (https://send.bitwarden.com).
  source: https://ndc.flybreeze.com/docs/ndc-for-developers/authentication
- name: SessionBearerToken
  type: http
  scheme: bearer
  bearerFormat: JWT
  applies_to: all Selling and Servicing routes, plus Shopping AirlineProfile
  description: >-
    Session bearer token returned by the Auth endpoint. Stateful — the token creates
    a unique session in the Breeze reservation system, so a new token must be
    obtained for each transaction flow. Concurrent use of one token across bookings
    causes failures.
  source: https://ndc.flybreeze.com/docs/ndc-for-developers/authentication
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  token_url: /api/Selling/r3.x/Auth
  token_url_optional_parameter: '?role={rolecode}'
  grant_type: client_credentials
  token_type: Bearer
  expires_in: 00:30:00
  token_lifetime_seconds: 1800
  token_audiences:
  - shopping
  - selling
  - servicing
  - orderchangenotification
  description: >-
    The Auth endpoint implements an OAuth 2.0 client-credentials style exchange —
    a JSON body of {"grant_type":"client_credentials"} with HTTP Basic credentials
    returns an access_token (JWT), token_type Bearer, and expires_in 00:30:00. The
    JWT aud claim carries the four authorized service audiences. Declaring the
    optional role query parameter makes the token request roughly twice as fast
    because the gateway then avoids an extra reservation-system lookup.
  source: https://ndc.flybreeze.com/docs/ndc-for-developers/authentication
authorization_by_route:
- route: /api/Selling/r3.x/Auth
  methods: [POST]
  authorization: Basic
  message: Authorization
- route: /api/Shopping/r3.x/v21.3/AirlineProfile
  methods: [GET, POST]
  authorization: Bearer
  message: IATA_AirlineProfileRQ / IATA_AirlineProfileRS
- route: /api/Shopping/r3.x/v21.3/AirShopping
  methods: [GET, POST]
  authorization: none
  message: IATA_AirShoppingRQ / IATA_AirShoppingRS
- route: /api/Selling/r3.x/v21.3/SeatAvailability
  methods: [POST]
  authorization: Bearer
  message: IATA_SeatAvailabilityRQ / IATA_SeatAvailabilityRS
- route: /api/Servicing/r3.x/v21.3/SeatAvailability
  methods: [POST]
  authorization: Bearer
  message: IATA_SeatAvailabilityRQ / IATA_SeatAvailabilityRS
- route: /api/Selling/r3.x/v21.3/ServiceList
  methods: [POST]
  authorization: Bearer
  message: IATA_ServiceListRQ / IATA_ServiceListRS
- route: /api/Servicing/r3.x/v21.3/ServiceList
  methods: [POST]
  authorization: Bearer
  message: IATA_ServiceListRQ / IATA_ServiceListRS
- route: /api/Selling/r3.x/v21.3/OfferPrice
  methods: [POST]
  authorization: Bearer
  message: IATA_OfferPriceRQ / IATA_OfferPriceRS
- route: /api/Selling/r3.x/v21.3/OrderCreate
  methods: [POST]
  authorization: Bearer
  message: IATA_OrderCreateRQ / IATA_OrderViewRS
- route: /api/Servicing/r3.x/v21.3/OrderRetrieve
  methods: [POST]
  authorization: Bearer
  message: IATA_OrderRetrieveRQ / IATA_OrderViewRS
- route: /api/Servicing/r3.x/v21.3/OrderChange
  methods: [POST]
  authorization: Bearer
  message: IATA_OrderChangeRQ / IATA_OrderViewRS
- route: /api/Servicing/r3.x/v21.3/OrderReshop
  methods: [POST]
  authorization: Bearer
  message: IATA_OrderReshopRQ / IATA_OrderReshopRS
- route: /api/Servicing/r3.x/v21.3/OrderQuote
  methods: [POST]
  authorization: Bearer
  message: IATA_OrderQuoteRQ / IATA_OrderReshopRS
onboarding:
  prerequisites:
  - IATA or ARC agency number
  - Executed commercial agreement (agreement in principle accepted for sandbox access)
  - Declared agency content type (leisure, business/corporate, or federal government)
  - List of egress IP addresses for sandbox and production allowlisting
  credential_delivery: https://send.bitwarden.com
  ip_allowlist_sla: requests to allow additional IPs are typically fulfilled within one week
  source: https://ndc.flybreeze.com/docs/ndc-for-developers/getting-started
x-evidence:
  fetched: '2026-08-01'
  urls:
  - url: https://ndc.flybreeze.com/docs/ndc-for-developers/authentication
    http_status: 200
  - url: https://ndc.flybreeze.com/docs/ndc-for-developers/getting-started
    http_status: 200