Quickstart

Make your first AirShopping call in 5 steps — from credentials to a live flight-search response. This guide uses the Sandbox environment, which is provisioned automatically when your account is onboarded.

Need an account first? Credentials are issued during onboarding, not here. → Supported Airlines & Onboarding

At a glance

① Credentials → ② Endpoint → ③ HMAC headers → ④ AirShopping call → ⑤ Read response  ──▶  next: OfferPrice → OrderCreate

🧩 Key idea: Your credentials do three different jobs — some sign the request, one points it to the right URL, and others identify your agency inside the body. They are not interchangeable. Keeping this straight is the single biggest thing that prevents errors.

1. Get your credentials

When auto-onboarding completes, the "Your HaloSync Account is Ready" screen shows everything you need.
(Missed the screen? Sign in to Albus (sandbox) → PolarHub Credential — all four values are there too.)

Group your 4 values by the job they do:

Job	Value(s)	Goes into
🔏 Sign the request	TenantID	Authorization header — `username`
	PolarHub API Key	Authorization header — `signature`
🌐 Point the request	PolarHub Endpoint	The request URL (Step 2)
📦 Identify your agency	AgencyID / SalesBranchID	Request body — `Sender.TravelAgency`

⚠️ The signing values (header) and the agency values (body) are not interchangeable — mixing them up is a common cause of auth errors. (SalesBranchID is the branch value set in Albus.)

2. Set your endpoint

Take the PolarHub Endpoint from Step 1 and append the AirShopping path:

POST {POLARHUB_ENDPOINT}/hub/polarpie/v2/airShopping

Optional — AirShoppingPlus: {POLARHUB_ENDPOINT}/exp/polarhub/v2/airshopping applies response-side offer curation. For the shortest path, use the Default endpoint above; see the AirShopping page for AirShoppingPlus.

3. Build the HMAC headers

Every request is signed. Algorithm: HMAC-SHA512. A request is valid only within ±120 seconds of server time, so keep your clock synced (NTP).

You need four headers:

Header	What to put in it
`x-date`	Current timestamp in GMT, RFC1123 format
`Digest`	`SHA-512=` + Base64( SHA-512 of the raw request body )
`Authorization`	See the format below
`Content-Type`	`application/json`

How Authorization is built:

Authorization: hmac username="YOUR_TENANT_ID", algorithm="hmac-sha512", headers="x-date digest", signature="BASE64_HMAC_SHA512_OF_XDATE_PLUS_DIGEST"

username = your TenantID

signature = HMAC-SHA512 of (x-date + digest), keyed with your PolarHub API Key, then Base64-encoded

Example header set:

x-date:        Tue, 26 Aug 2025 10:12:34 GMT
Digest:        SHA-512=BASE64_SHA512_OF_BODY
Authorization: hmac username="YOUR_TENANT_ID", algorithm="hmac-sha512", headers="x-date digest", signature="BASE64_HMAC_SHA512_OF_XDATE_PLUS_DIGEST"
Content-Type:  application/json

💡 Don't hand-build the signature string. Use the working sample code on the Authentication: HMAC Guide (Node.js, Python, Java, Postman) as the source of truth.

4. Make your first AirShopping call

Required: Sender, PointOfSale, TransactionID, Query.
Inside Query, only OriginDestList and PaxList are required — Cabin and Criteria are optional (shown below for a typical search).

🔑 TransactionID is a body field, not a header. It's a unique 32-character value (a UUID with the hyphens removed) used as the internal log-tracking key. Generate one per AirShopping session, then reuse the same value for the OfferPrice and OrderCreate calls that follow.

Minimal request body:

{
  "Sender": { "TravelAgency": { "AgencyID": "YOUR_AGENCY_ID", "SalesBranchID": "01" } },
  "PointOfSale": "KR",
  "TransactionID": "YOUR_TRANSACTION_ID_32HEX_UNIQUE",
  "Query": {
    "OriginDestList": [
      { "OriginCode": "ICN", "DestCode": "SIN", "DepartureDate": "2026-09-10" }
    ],
    "PaxList": [ { "Ptc": "ADT", "PaxID": "PAX1" } ],
    "Cabin": "Y",
    "Criteria": { "Direct": false, "AirlinePreference": { "AirlineID": ["SQ"] } }
  }
}

Field notes:

PaxList.Ptc — ADT / CHD / INF, up to 9 passengers.

Cabin — Y / W / C / F.

Criteria.AirlinePreference.AirlineID — omit to search all carriers, or list specific ones.

5. Read the response & continue

Read the AirShoppingRS response in this order:

ResultMessage — check this first: confirms success, or gives error details.

Offer[] — each offer holds its OfferItem[] (fares, baggage, fare rules). Iterate to find the one you want.

DataLists — flight details live here. Offers reference PaxJourney / PaxSegment entries by ID, which hold the actual segments, carriers, times, and equipment.

Then continue the booking flow — reusing the same TransactionID throughout:

This AirShopping  →  OfferPrice (same TransactionID)  →  OrderCreate (same TransactionID)

⚠️ Partial results: When MatchResult = Partial (e.g. LH, EK), per-leg offers must follow the combinability hints in AugmentationPoint before being priced as a round trip. This is beyond the Quickstart — see the AirShopping page.

Next steps

Activate Albus & Luna — use the activation links in your onboarding email to set a password and sign in.

Authentication (HMAC) — full signing reference and sample code.

Transaction ID Guidelines — when to generate vs. reuse a Transaction ID.

API Reference → OfferPrice / OrderCreate — complete the booking flow.

📌 For BA, AF, KL, OrderCreate requires agency contact info (ContactInfoRefID: email, plus address/phone depending on the carrier). A missing value returns an error.

📮 Support — Inquiries: email halosync_support@halocorp.kr, or check FAQ & Contact. To report a problem, follow Reporting an Issue.

1. Get your credentials#

2. Set your endpoint#

3. Build the HMAC headers#

4. Make your first AirShopping call#