Docs · Technical · plugin 1.1.16-dev
For developers and technical partners. Request/response JSON fields are not invented: if the code does not reveal a field, it is marked NOT DETERMINED FROM CURRENT EVIDENCE.
Browser never calls LiteAPI with the private key. Full diagram: architecture.md.
Live (SSH read-only 30 Aug 2026): WordPress 7.1, PHP 8.5.4. Plugin header requires PHP ≥ 8.1. REST namespace registered by the plugin. Production files were not modified for documentation.
Live theme: Traveler 3.2.9 (Shinetheme), no child theme. Elementor present. Alya injects shortcodes; Traveler owns header/footer/chrome.
hoteldz.tech is not the currently identified live WordPress theme. If it appears in older notes, treat it as historical/context only — not the live stack on alyatrip.com.
Entry: alya-hotel-system.php. Asset rev ALYA_HS_ASSET_REV r64pay. Schema version 1.1.21-perf-idx.
Shortcodes: alya_hotel_search|details|rates|checkout|confirmation|voucher, alya_flight_booking, alya_unified_search, alya_my_bookings, alya_account, alya_faq, alya_support / alya_helpdesk.
Cron (code): alya_hs_cron_purge_logs, alya_hs_cron_ops_alerts, alya_hs_cron_ops_digest, alya_hs_cron_ops_tick, destination sync, BookingRetryJob, helpdesk SLA.
Host cron execution on production: Requires access (not claimed from WP-CLI this pass).
Namespace alya/v1. ~100 register_rest_route registrations across hotel, flights, cockpit, helpdesk, ops, webhooks.
Public: wp_rest nonce + IP buckets. Staff: capabilities. Errors: WP_Error JSON. Rate limit → 429 + Retry-After. Circuit open → 429.
| Method | Endpoint | Purpose | Auth | External | DB |
|---|---|---|---|---|---|
| GET | /places | Autocomplete | nonce 30/600 | LiteAPI places | — |
| GET | /search | Hotel list | nonce 40/600 | hotels search | cache possible |
| GET | /hotel-details | Fiche | nonce | hotel | cache possible |
| POST | /rates | Offers + margin | nonce 20/600 | hotels/rates | — |
| POST | /prebook | Lock rate | nonce | rates/prebook | prebook CPT/index |
| POST | /book | Confirm | nonce 10/600 | rates/book | CPT confirmed — not called this audit |
| POST | /cancel | Hotel cancel | staff | cancel | status log |
| GET | /config | Public config | public | none | none — no secrets |
| POST | /webhooks/nuitee | Inbound | token; HMAC optional | inbound | webhook_events |
Request/response field lists: NOT DETERMINED FROM CURRENT EVIDENCE beyond what PHP services expose. See rest-api-reference.md.
Flights: airports 30/600, search 10/600, verify 15/600, prebook 8/600. Live search this pass failed on nonce before LiteAPI.
Hosts: https://api.liteapi.travel/v3.0, https://book.liteapi.travel/v3.0. Header X-API-Key from vault (sand_ / prod_). Secrets are not published in this dossier.
Architecture: Alya → REST alya/v1 → Nuitee → hotel/flight services.
Dashboard fournisseur : https://connect.nuitee.com/ (pas le cockpit Alya).
Canvas complet (14 août 2026, lecture seule) : connector/alya-connector-audit.html. Plugin 1.1.16-dev : vols via LiteAPI / alya/v1. Offres / Pay / book : REQUIRES ACCESS.
Full mapping: nuitee-liteapi-audit.md.
See payment-complete-guide.html. Traveler: TRANSACTION_ID. Agency: ACC_CREDIT_CARD, WALLET, CREDIT (production only in JS).
includes/Pricing/PricingEngine.php injects LiteAPI margin. Live 10%, overlay 0. Cap 0–90.
DataProvider::commission_estimate = selling × margin / (100 + margin) when net not persisted. Reports observed 313.30 vs 313.34. Commission guide.
CPT alya_booking is the WP operational row. Custom tables prefix alya_hs_ are mirrors. Supplier of record remains LiteAPI bookingId.
Tables (schema): agencies, agency_users, customers, hotels (cache), destinations, pricing_rules, booking_index, booking_rooms, booking_guests, booking_prices, booking_policies, payments, audit_log, credit_tx, api_logs, webhook_events, booking_status_log, documents, email_log, flight_sessions, booking_amendments, flight_services, helpdesk_*.
credit_tx: schema only, no INSERT. Relationships only as supported by repositories — no invented FKs. database-architecture.md.
Verified: Administrator, Alya Agency Admin, Alya Agency Staff, public traveler (no WP role).
NOT FOUND: Hotel Manager, Reception, Accountant, Corporate.
Caps in AdminCapabilities.php / AgencyRoles.php. Staff cannot vault, purge, or agent-book. Agency Admin has no manage_options. Matrix: 03-permissions-matrix.csv.
Inbound POST /alya/v1/webhooks/nuitee. HMAC inbound OFF live and default. Authorization token path exists. Do not claim HMAC-verified ingest on this environment.
No invented certifications. Vault screenshot: hints only if captured. GDPR: WP exporters/erasers in Compliance/Gdpr.php — they do not cancel supplier LiteAPI bookings. security-audit.md.
alya_hs_api_logs indexes: created_at, channel, level, http_status, prebook_id, booking_id. Daily purge cron in code. Live log screen: SCREENSHOT REQUIRED.
Templates under templates/documents/. PDF via Dompdf if installed. QR Not found. Voucher not generated this audit.
Booking confirmed/cancelled, helpdesk, ops via wp_mail. SMTP host config: Requires access. WhatsApp: not implemented (comment only).
Hostinger de-fra-web2149.main-hosting.eu, LiteSpeed, WPvivid present. HTTPS. DNS A/CNAME: UNKNOWN this pass. infrastructure-audit.md.
Plugin may be installed. Not the Nuitee booking payment engine. woocommerce.md.
Traveler + Elementor pages host Alya shortcodes. JS: alya-hotel.js, alya-flights.js, cockpit hashes in FrontDashboard/RenderHelpers.php nav(). Favorites: localStorage. Public pages never send X-API-Key.
Cockpit URL: /function-user-settings/. WP admin: page=alya-hotel-system (SCREENSHOT REQUIRED this pass).