# Sabre > Sabre: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. ![](/_astro/sabre.BwCnXmzW.png)Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the bookings you name, by confirmation id, from Sabre’s Get Booking API, read-only, inside your deployment. Travel documents are left out. ## At a glance | Collector | Sabre, version `1.0.0` | | --------------------------- | -------------------------------------------------------------------------------------------- | | Reads | Sabre: Sabre Get Booking (REST) ([the vendor's documentation](https://developer.sabre.com/)) | | Family | Aviation | | Kind | Reservations | | Ways to connect | OAuth approval | | Scopes | - Read: | | Read only | Yes, except: \[object Object]; \[object Object] | | Vendor's API can move money | No | | Personal data | Travel, Identity, Contact | | Hosts it may contact | `api.platform.sabre.com`, `api-crt.cert.havail.sabre.com`, `{environment}` | | Vendor API versions | Auth token v2 (/v2/auth/token), Get Booking (/v1/trip/orders/getBooking) | | Lowest engine version | `0.46.0` | ## What it reads - For each confirmation id you name: the booking, from `POST /v1/trip/orders/getBooking`. Sabre defines this retrieval as a `POST`; it is a read. - One record per booking, with the booking’s traveller count in its metadata. The rest of the response is indexed as served, minus the excluded fields. - A booking that answers 404 is gone: its record is withdrawn. - It never searches or lists: you name the bookings. The airline-hosted reservation APIs are a separate collector that needs onboarding. ## How to connect 1. Make a Dev Studio application at Sabre for certification credentials; production credentials come through your Sabre account manager (an EPR). 2. In LightHouse, open **Setup and admin, Connectors**, choose **Sabre**, and leave the access level at **Read**. 3. Name the `environment` (`cert` or `production`) and the `confirmations` (5 to 8 letters and digits). 4. Paste the EPR credential (`V1:::`) and then its password. Your browser seals them to your deployment, which hands them to the collector as `SABRE_CLIENT_ID` and `SABRE_CLIENT_SECRET`. ## Permissions - The collector asks for no scope and refuses a token whose granted scope names a write. - It sends two `POST`s and nothing else: the token request (`/v2/auth/token`) and Get Booking (`/v1/trip/orders/getBooking`), both listed in the manifest’s `read_operations`. The path of the second is fixed in code. - Your deployment refuses to store this credential at read and write. The environment you choose picks the host; a certification token works only in certification. ## Limits - Sabre publishes no paging, rate limit or change feed for this call: the named bookings are read again each run and unchanged ones are not rewritten. - The host and token facts come from Sabre’s own pages as search indexes them (developer.sabre.com no longer serves pages to an automated reader); confirm them in Dev Studio when connecting. - The default pace is one request a second (`delay_s`); `429` and `5xx` are retried with backoff and `Retry-After`. ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a booking or a traveller. - Nothing is cached raw: a raw cache would keep on disk the fields the exclusion removes. A failure names the host and the status, never the URL, because a URL can carry a record locator or a bag tag. - By default travel document numbers, dates of birth and health or disability special service requests (MEDA, WCHR, BLND and the rest of the IATA health set) are left out before a record is written. `exclude_fields` adds paths; `keep_fields` takes a default back by its exact name, and that choice is your record of the decision. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------ | ------------------------------------------------ | ----------------------------------------------------------------------------------------------- | | `credential variable 'SABRE_CLIENT_ID' is not set` | The deployment has not been given the credential | Connect it again | | `the Sabre client id is V1:::` | The EPR credential is not in Sabre’s form | Paste the full `V1:...` string | | `POST api-crt.cert.havail.sabre.com: HTTP 401` | Sabre refused the credential | Check the environment (a certification credential does not work on production) and the password | | `POST api-crt.cert.havail.sabre.com: no access token` | The token response held no token | Check the credential and the environment | | `environment is cert or production` | Any other value | Choose one of the two | | `name the bookings to read by confirmation id` | No confirmation id | Name at least one | | `N confirmation ids are not 5 to 8 letters and digits` | A confirmation id is malformed | Correct the ids | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | Auth token v2, Get Booking (/v1/trip/orders/getBooking) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/sabre/