# Nuitee Connect / LiteAPI audit

Auth: `X-API-Key` from `ApiKeyVault` (`sand_` / `prod_`). Never in the browser.

## Hosts

- Data/rates: `https://api.liteapi.travel/v3.0`
- Book: `https://book.liteapi.travel/v3.0`

## Hotels (NuiteeClient)

| Method | LiteAPI | WP REST |
|--------|---------|---------|
| GET | `/data/places` | `/alya/v1/places` |
| GET | `/data/places/{id}` | `/place-details` |
| GET | `/data/hotels` | `/search` |
| GET | `/data/hotel` | `/hotel-details` |
| POST | `/hotels/rates` | `/rates` |
| POST | `/hotels/min-rates` | `/hotels/min-rates` (flag default off) |
| POST | `/rates/prebook` | `/prebook` |
| POST | `/rates/book` | `/book` |
| GET/PUT | `/bookings/{id}` | `/booking/{id}`, `/cancel` |
| POST | `/rates/rebook` | amendment routes |

Errors: `NuiteeException`, circuit breaker 5×429/60s → 60s, RateLimitTracker, no auto-retry on book.

Webhooks: `POST /alya/v1/webhooks/nuitee` token; HMAC default off.

## Flights (NuiteeFlightsClient)

`/flights/rates`, `/flights/verify`, `/flights/prebooks`, `/flights/bookings`, cancellations, services on prebook. WP maps to `/alya/v1/flights/*`.

## Frontend exposure

Nonce + public config (currency, colors). No API key, no `secretKey` in `/config`. `secretKey` only after prebook, redacted in logs.

---

## Architecture (confirmed)

```
Traveler
  → https://alyatrip.com (Traveler theme + Alya shortcodes)
  → REST /wp-json/alya/v1
  → Alya Hotel System
  → X-API-Key (vault)
  → LiteAPI inventory / prebook / book / flights
```

API keys never leave the server. `VERIFIED IN CODE`

## Error handling

`NuiteeException`. Circuit breaker: 5× HTTP 429 in 60s → open 60s. `RateLimitTracker`. Book: no auto-retry. Live flight search: expired nonce message (not a LiteAPI 429). `VERIFIED LIVE`

## Webhooks

Live: HMAC **OFF**, 4 events, endpoint `/wp-json/alya/v1/webhooks/nuitee`. Screenshot: `../screenshots/backoffice/08-webhooks-01-overview.png`

## bookingId

Supplier id stored as CPT `_alya_booking_id` / `nuitee_booking_id`. **Not generated in this audit’s hotel Pay.** Webhook table showed a `booking.book` event from earlier SANDBOX activity — not this pass’s traveler journey.

## Cancellation

Hotels: staff REST `/cancel`. Flights: traveler quote + confirm in code.