Connect API v1

Base URL

Canonical API host: https://api.fly-and-drive.com/v1

OpenAPI spec: api.fly-and-drive.com/openapi. Legacy portal path /api/connect/v1 on developer.fly-and-drive.com remains supported.

Authentication

Header Authorization: Bearer fd_connect_test_... or fd_connect_live_...

Rate limit: 10 requests per second per Connect partner. Every response includes X-RateLimit-Limit and X-RateLimit-Remaining. HTTP 429 when exceeded.

Search: GET /search/drive

Query: airport, from, to (YYYY-MM-DD)

GET https://api.fly-and-drive.com/v1/search/drive?airport=NCE&from=2026-09-01&to=2026-09-08

Booking: POST /bookings

JSON body: offerId, airportIata, pickupDate, returnDate, customer

Optional: Idempotency-Key header (1–256 chars, 24h TTL — replays return the same response; concurrent duplicate returns HTTP 409); anytimeFlex defaults to false

Status: GET /bookings/:id

Returns booking status and voucherToken when confirmed.

Embed widget: GET /api/connect/widget-config

Returns theme (accent color, logo, allowed domains) for the embed widget loader at /connect/widget.js. Authenticate with Bearer or ?key=fd_connect_....

Customize theme in the dashboard; this endpoint is read-only for the widget runtime.

Webhooks

Register separate test and live URLs in the dashboard. Events are routed by API key environment only.

Events: booking.created, booking.confirmed, booking.rejected, booking.cancelled

booking.cancelled includes cancelledBy, refundAmount, and penaltyAmount when a customer cancels via the app.

Failed deliveries are retried automatically (3 attempts, 60s then 5min backoff). Verify with the Fly-Drive-Signature HMAC header.

Signature: Fly-Drive-Signature header (HMAC-SHA256). Use the whsec_ signing secret from the dashboard to verify payloads.

Environments

• test: sandbox inventory (is_sandbox partners), wallet payment
• live: production fleet, Stripe Checkout