Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.Reads the bookings you name, by confirmation id, from Sabre’s Get Booking API, read-only, inside your deployment. Travel documents are left out.
| Collector | Sabre, version 1.0.0 |
|---|
| Reads | Sabre: Sabre Get Booking (REST) (the vendor's documentation) |
|---|
| Family | Aviation |
|---|
| Kind | Reservations |
|---|
| Ways to connect | OAuth approval |
|---|
| Scopes | |
|---|
| Read only | Yes, except: [object Object]; [object Object] |
|---|
| Vendor's API can move money | No |
|---|
| Personal data | Travel, Identity, Contact |
|---|
| Hosts it may contact | api.platform.sabre.com, api-crt.cert.havail.sabre.com, {environment} |
|---|
| Vendor API versions | Auth token v2 (/v2/auth/token), Get Booking (/v1/trip/orders/getBooking) |
|---|
| Lowest engine version | 0.46.0 |
|---|
- For each confirmation id you name: the booking, from
POST /v1/trip/orders/getBooking. Sabre defines this retrieval as a POST; it is a read.
- One record per booking, with the booking’s traveller count in its metadata. The rest of the response is indexed as served, minus the excluded fields.
- A booking that answers 404 is gone: its record is withdrawn.
- It never searches or lists: you name the bookings. The airline-hosted reservation APIs are a separate collector that needs onboarding.
- Make a Dev Studio application at Sabre for certification credentials; production credentials come through your Sabre account manager (an EPR).
- In LightHouse, open Setup and admin, Connectors, choose Sabre, and leave the access level at Read.
- Name the
environment (cert or production) and the confirmations (5 to 8 letters and digits).
- Paste the EPR credential (
V1:<user>:<group>:<domain>) and then its password. Your browser seals them to your deployment, which hands them to the collector as SABRE_CLIENT_ID and SABRE_CLIENT_SECRET.
- The collector asks for no scope and refuses a token whose granted scope names a write.
- It sends two
POSTs and nothing else: the token request (/v2/auth/token) and Get Booking (/v1/trip/orders/getBooking), both listed in the manifest’s read_operations. The path of the second is fixed in code.
- Your deployment refuses to store this credential at read and write. The environment you choose picks the host; a certification token works only in certification.
- Sabre publishes no paging, rate limit or change feed for this call: the named bookings are read again each run and unchanged ones are not rewritten.
- The host and token facts come from Sabre’s own pages as search indexes them (developer.sabre.com no longer serves pages to an automated reader); confirm them in Dev Studio when connecting.
- The default pace is one request a second (
delay_s); 429 and 5xx are retried with backoff and Retry-After.
- Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a booking or a traveller.
- Nothing is cached raw: a raw cache would keep on disk the fields the exclusion removes. A failure names the host and the status, never the URL, because a URL can carry a record locator or a bag tag.
- By default travel document numbers, dates of birth and health or disability special service requests (MEDA, WCHR, BLND and the rest of the IATA health set) are left out before a record is written.
exclude_fields adds paths; keep_fields takes a default back by its exact name, and that choice is your record of the decision.
| What you see |
What it means |
What to do |
credential variable 'SABRE_CLIENT_ID' is not set |
The deployment has not been given the credential |
Connect it again |
the Sabre client id is V1:<user>:<group>:<domain> |
The EPR credential is not in Sabre’s form |
Paste the full V1:... string |
POST api-crt.cert.havail.sabre.com: HTTP 401 |
Sabre refused the credential |
Check the environment (a certification credential does not work on production) and the password |
POST api-crt.cert.havail.sabre.com: no access token |
The token response held no token |
Check the credential and the environment |
environment is cert or production |
Any other value |
Choose one of the two |
name the bookings to read by confirmation id |
No confirmation id |
Name at least one |
N confirmation ids are not 5 to 8 letters and digits |
A confirmation id is malformed |
Correct the ids |
Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.
| Date | Collector | Engine | Vendor API | Method | Expires |
|---|
| 10 November 2026 | 1.0.0 | 0.47.0 | Auth token v2, Get Booking (/v1/trip/orders/getBooking) | Fixtures only: built, not certified | Not applicable |
From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.
| Last scanned | 10 November 2026 |
|---|
| Critical findings | 0 |
|---|
| High findings | 0 |
|---|
| Medium findings | 0 |
|---|
| Low findings | 0 |
|---|
| Info findings | 0 |
|---|
| Release blocked | No |
|---|
| Network allow-list check | Pass |
|---|
| Read-only behavioural test | Pass |
|---|
| SBOM (CycloneDX) | Produced |
|---|
| Dependency licences | Pass |
|---|
| Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only |
|---|
