TENANT API · V1
Create cancellation requests Reason + ETag returns applied cancellation or tracked request.
POST /api/v1/tenant/orders/{id}/cancellation-requests
Authorization Use a server-side API key with the listed grants and permitted resource access.
Path parameters
idstring · required Opaque identifier in the authorized resource scope. Nested identifiers must belong to their parent resource. Request body
reasonstring · required A clear reason for this action, retained in the audit history. Response 201 Created
Returns the authorized resource or result for this operation. List results use items, nextCursor, and hasMore.
Errors Authentication failures return 401 or 403. Inaccessible resources return 404. Business and idempotency conflicts return 409. Rate limits return 429 with retry guidance.
Error handling guide REQUEST API key
curl --request POST 'https://api.wincora.com/api/v1/tenant/orders/id_example/cancellation-requests' \
--header 'X-Api-Key: YOUR_API_KEY' \
--header 'Idempotency-Key: request-example-001' \
--header 'If-Match: "resource-version"' \
--header 'Content-Type: application/json' \
--data '{
"reason": "The traveler’s plans have changed."
}' const response = await fetch ( 'https://api.wincora.com/api/v1/tenant/orders/id_example/cancellation-requests' , {
method: 'POST' ,
headers: {
"X-Api-Key" : process.env. WINCORA_API_KEY ,
"Idempotency-Key" : "request-example-001" ,
"If-Match" : " \" resource-version \" " ,
"Content-Type" : "application/json"
},
body: JSON . stringify ({
"reason" : "The traveler’s plans have changed."
})
});
if ( ! response.ok) throw new Error ( await response. text ());
const result = await response. json (); import os
import requests
response = requests.request(
'POST' ,
'https://api.wincora.com/api/v1/tenant/orders/id_example/cancellation-requests' ,
headers = {
"X-Api-Key" : os.environ[ "WINCORA_API_KEY" ],
"Idempotency-Key" : "request-example-001" ,
"If-Match" : " \" resource-version \" " ,
"Content-Type" : "application/json"
},
json = {
"reason" : "The traveler’s plans have changed."
},
timeout = 30 ,
)
response.raise_for_status()
result = response.json() Keep this API key on your server. Never embed it in browser or mobile code.